Digital markets increasingly operate through the large-scale collection, processing, and monetisation of consumer data, transforming personal information into a central source of economic power. Contemporary regulatory frameworks governing such markets rely on individual consent as the primary mechanism legitimising data collection and use, reflecting a belief that informed consumer choice safeguards autonomy and market fairness.1 Competition law, by contrast, continues to assess market power through traditional indicators such as dominance, pricing behaviour, and output restrictions.2 This regulatory separation assumes that consent-based data governance can operate independently of competition law concerns. Scholarship and enforcement experience suggest, however, that in data-driven markets characterised by informational asymmetries, behavioural manipulation, and limited alternatives, consent often functions as a formal compliance device rather than a meaningful expression of choice.3 As a result, firms may lawfully accumulate extensive data advantages that entrench market power without engaging in conduct that triggers conventional antitrust scrutiny.4
This paper interrogates the role of consent within data-driven markets and questions its assumed capacity to function as a safeguard against the persistence of market power. It argues that consent-based governance, while central to data-protection regimes, is structurally not suitable to address competition concerns arising from the accumulation and strategic use of consumer data. Competition law’s continued reliance on indicators such as dominance, pricing conduct, and exclusionary behaviour fails to capture how data advantages are lawfully consolidated through consent-driven mechanisms.5 Drawing on competition-authority materials and scholarly literature, the paper demonstrates that consent neither neutralises informational asymmetries nor constrains the feedback loops through which data-driven firms entrench market power.6 Through a comparative analysis of the European Union, the United States, Australia, and India, the paper situates this critique within existing legal frameworks and advances a structural understanding of market power that operates independently of individual choice. It concludes by arguing for a recalibration of competition law that recognises the limits of consent and strengthens market-level safeguards in digital economies.
The paper proceeds as follows. Part II analyses the legal concept of consent in data-protection law. Part III examines how data accumulated under consent translates into market power. Part IV explains why consent cannot cure the resulting competitive harm. Part V undertakes a comparative regulatory analysis. Part VI advances a normative framework for competition law reform. Part VII concludes.
Consent, as a legal concept in data-protection law, functions as a justificatory mechanism that permits the collection and processing of personal data on the basis of individual authorisation. Across jurisdictions, consent is premised on the assumption that individuals are capable of exercising meaningful choice regarding the use of their personal information and that such choice legitimises subsequent data practices.7 While doctrinal formulations differ, the underlying purpose of consent remains consistent: to translate individual autonomy into a lawful basis for data processing and to allocate responsibility for data-disclosure decisions to the data subject.8
Most data-protection regimes define valid consent through a set of core parameters intended to safeguard individual control. These parameters commonly require that consent be freely given, informed, specific, and unambiguous, requiring a clear affirmative act.9 In theory, these conditions are designed to prevent exploitative data practices and preserve individual autonomy. Their effectiveness, however, depends on market conditions that allow for genuine alternatives, comprehension, and bargaining capacity — conditions frequently absent in concentrated digital markets.10
These conceptual parameters are reflected, with jurisdictional variation, across major data-protection frameworks. In the European Union, the General Data Protection Regulation adopts a rights-based approach, defining consent as a freely given, specific, informed and unambiguous indication of the data subject’s wishes and reinforcing this definition through procedural safeguards.11 The United States follows a fragmented, sector-specific notice-and-choice model in which consent is primarily procedural and rarely interrogated for substantive imbalance or market power.12 Australia’s Privacy Act similarly relies on voluntariness and informed agreement, positioning individual choice as the primary regulatory safeguard even in highly concentrated digital markets.13 India’s Digital Personal Data Protection Act 2023 adopts a consent-centric framework inspired by European models, requiring free, specific, informed, and unconditional consent, yet operates within a market environment characterised by significant platform dominance.14 Despite doctrinal differences, all four regimes share a common assumption: that individual consent can meaningfully constrain data-driven economic power.
In digital markets, data operates as a critical economic resource capable of conferring durable market power. Firms that collect and process large volumes of consumer data are able to improve predictive accuracy, refine personalisation, and optimise product design and pricing in ways that competitors without comparable datasets cannot easily replicate.15 Unlike traditional inputs, data benefits from scale and feedback effects: increased user engagement generates more data, which in turn enhances service quality and attracts additional users, creating a self-reinforcing cycle of advantage.16 This cumulative dynamic enables firms to consolidate competitive power without resorting to conduct traditionally associated with anticompetitive behaviour.
The competitive significance of data is further amplified by market structures characteristic of digital platforms. Network effects, economies of scale, and switching costs raise entry barriers for new or smaller firms that lack access to equivalent datasets.17 As competition authorities have increasingly recognised, control over large and diverse datasets may therefore function as a proxy for market power, even where firms offer services at zero monetary price and do not engage in overt exclusionary practices.18 Traditional indicators of dominance, focused on price increases or output restrictions, are often ill-suited to capture these dynamics.19
Crucially, much of this data accumulation occurs through consent-based mechanisms that are formally compliant with data-protection law.20 Firms may lawfully obtain extensive consumer data through valid consent while simultaneously strengthening their competitive position and entrenching market power. The transformation of data into market power thus exposes a structural limitation in competition law: the legality of data collection does not negate the cumulative and exclusionary effects of data concentration on market structure.21
In legal scholarship on digital markets, the prevailing view is that individual consent cannot remedy antitrust harm because it fails to address the structural and behavioural market failures inherent in dominant platforms. Consent in a concentrated environment is rarely freely given in the economic sense. Choice architecture and dark patterns are used to nudge users into consenting to data-sharing or default settings that entrench a firm’s position, exploiting cognitive shortcuts — particularly status-quo bias — so that consent becomes a product of friction rather than preference.22
Further, antitrust law protects the competitive process as a public good, and individual private contracts or consents cannot waive that protection.23 Within the gatekeeper framework, even where a user consents to a platform’s self-preferencing behaviour, that consent does not mitigate the foreclosure effects that prevent more efficient rivals from entering the market.24
Modern regulation reflects this shift. The Digital Markets Act explicitly prohibits certain practices regardless of whether a user has opted in, recognising that consent can itself be a tool for anticompetitive data-siloing.25 Competition policy now looks beyond individual transactions to ensure the digital ecosystem remains open: consent given inside a walled garden does not validate the wall itself. The result is a movement toward ex ante obligations that bypass the consent defence entirely and focus on the objective contestability of the market.26
The fundamental difficulty across legal systems is that consent is a bilateral concept — between an individual and a firm — while antitrust law is concerned with the structure of an entire market. The fact that many users have clicked “I agree” does not, by itself, establish that the market is competitive.
In the United States, enforcement is closely tied to price and output effects. Where a service is offered free of monetary charge and the user has consented to its use as a default, courts have historically been reluctant to intervene unless plaintiffs can demonstrate that the configuration of consumer choice itself forecloses entry by superior rivals. Hovenkamp has argued that this orientation reflects the underlying confusion in modern antitrust economics about the appropriate baseline for evaluating consumer harm in digital markets.27
The European Union has shifted most decisively away from a consent-centred model. The Digital Markets Act imposes obligations on designated gatekeepers — including restrictions on cross-service combination of personal data — that apply irrespective of whether end-users have provided consent in the data-protection sense.28 This represents a significant doctrinal departure: it treats consent as insufficient where the structural conditions of the market render that consent non-meaningful.
Australia has been comparatively more interventionist than the United States. The ACCC’s Digital Platforms Inquiry documented systematic information asymmetries between platforms and users and challenged the assumption that consumers genuinely choose to participate in extensive data-collection arrangements.29 The Inquiry’s recommendations called for stronger consumer-protection and privacy enforcement against the use of low-quality consent — such as lengthy terms-of-service agreements — to legitimise data practices in concentrated digital markets.30
India has begun to address the issue through enforcement under the Competition Act 2002. In Umar Javeed v Google, the CCI examined Google’s practice of pre-installing applications on Android devices and found that, even though users formally accepted those installations, the configuration produced a status-quo bias that operated independently of consent.31 The remedy adopted required Google to display choice screens through which users actively select their default services, rather than simply accept the pre-installed ones.32 The intervention illustrates a regulatory shift from improving consent to constraining the structural conditions under which consent is exercised.
The comparative analysis points to a convergence in direction across jurisdictions: competition law must move beyond reliance on consumer choice as the operative safeguard against data-driven market power. Three reforms follow from this diagnosis.
First, the operative criterion of market power should be reconceived to incorporate data accumulation as an independent indicator of competitive significance. As Khan has argued, the structural features that enable digital platforms to consolidate dominance — including the ability to extract surplus through cross-subsidisation and inferred user data — are typically invisible to the short-run price effects on which traditional consumer-welfare analysis focuses.33 Recognising data control as a parameter of market power, rather than as a downstream consequence of dominance, would bring competition analysis into closer alignment with the dynamics of contemporary markets.
Second, ex ante obligations on systemically significant firms should constrain the data-aggregation practices that compound market power, irrespective of whether end-users have provided formal consent. The European model under the Digital Markets Act offers a workable template: gatekeeper obligations apply to designated firms by reason of their structural position and operate without case-by-case consent inquiry. The Crémer/de Montjoye/Schweitzer report had earlier anticipated this orientation in arguing that data-driven market power required regulatory tools distinct from those developed for traditional industries.34 Larouche and de Streel have observed that the DMA achieves this by grafting an ex ante regime onto pre-existing competition-law principles rather than abandoning those principles.35
Third, institutional cooperation between data-protection and competition regulators should be formalised. The structural concerns identified in this paper sit at the intersection of the two regimes, and neither alone is sufficient. Where consent-based mechanisms compound market power, joint enforcement architectures — including information-sharing, coordinated investigations, and shared remedies — provide the most direct response.
Consent is a useful regulatory mechanism but a limited one. In concentrated digital markets, the assumption that individual choice can constrain firm conduct breaks down: consent is shaped by the very informational and structural conditions it is supposed to discipline. The accumulation of consumer data on the basis of formally valid consent has become a principal vehicle through which market power is consolidated and entrenched. Competition law cannot continue to address this phenomenon through doctrines designed for an earlier economic configuration.36
The comparative analysis above identifies the trajectory of reform. The European Union has moved most decisively to ex ante structural regulation; the United States is testing the limits of its existing instruments; Australia has used market-study and consumer-protection mechanisms to pressure for change; India has begun to address the problem through behavioural remedies under traditional competition law. None of these responses is complete, but each acknowledges, in different ways, that consent alone cannot bear the regulatory weight that has been placed upon it. The task for competition law is to develop analytical tools that recognise the structural - rather than merely the transactional - dimensions of data-driven market power.
1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) [2016] OJ L119/1, art 6(1)(a); Alessandro Acquisti, Laura Brandimarte and George Loewenstein, ‘Privacy and Human Behaviour in the Age of Information’ (2015) 347 Science 509, 509–512.
2. Richard Whish and David Bailey, Competition Law (10th edn, Oxford University Press 2021) 93–101.
3. Julie E Cohen, ‘Turning Privacy Inside Out’ (2019) 20(1) Theoretical Inquiries in Law 1, 6–10.
4. Autorité de la concurrence and Bundeskartellamt, Competition Law and Data (Joint Report, 10 May 2016) 11–18 https://www.autoritedelaconcurrence.fr/sites/default/files/competition-law-and-data-final.pdf accessed 11 May 2026.
5. Lina M Khan, ‘Amazon’s Antitrust Paradox’ (2017) 126 Yale Law Journal 710, 772–780.
6. Ariel Ezrachi and Maurice E Stucke, Virtual Competition: The Promise and Perils of the Algorithm-Driven Economy (Harvard University Press 2016) 35–42.
7. Paul M Schwartz and Daniel J Solove, ‘The PII Problem: Privacy and a New Concept of Personally Identifiable Information’ (2011) 86 New York University Law Review 1814, 1835–1838.
8. Julie E Cohen, ‘What Privacy Is For’ (2013) 126 Harvard Law Review 1904, 1923–1928.
9. European Data Protection Board, Guidelines 05/2020 on Consent under Regulation 2016/679 (version 1.1, 4 May 2020) paras 13–25 https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-eu_en accessed 11 May 2026.
10. Cohen (n 3) 12–14.
11. GDPR (n 1) arts 4(11) and 7.
12. Federal Trade Commission, Privacy and Data Security Update (FTC, 2021) https://www.ftc.gov/reports/privacy-data-security-update-2021 accessed 11 May 2026.
13. Office of the Australian Information Commissioner, Australian Privacy Principles Guidelines (OAIC, 2019) ch B https://www.oaic.gov.au/privacy/australian-privacy-principles-guidelines accessed 11 May 2026.
14. Digital Personal Data Protection Act 2023 (India), ss 6 and 7.
15. Ezrachi and Stucke (n 6) 67–72.
16. OECD, Big Data: Bringing Competition Policy to the Digital Era (DAF/COMP(2016)14, 27 October 2016) 9–14 https://www.oecd.org/competition/big-data-bringing-competition-policy-to-the-digital-era.htm accessed 11 May 2026.
17. David S Evans and Richard Schmalensee, Matchmakers: The New Economics of Multisided Platforms (Harvard Business Review Press 2016) 23–29.
18. Autorité de la concurrence and Bundeskartellamt (n 4) 18–25.
19. Jacques Crémer, Yves-Alexandre de Montjoye and Heike Schweitzer, Competition Policy for the Digital Era (Publications Office of the European Union 2019) 31–36 https://ec.europa.eu/competition/publications/reports/kd0419345enn.pdf accessed 11 May 2026.
20. EDPB (n 9) paras 38–42.
21. OECD Big Data (n 16) 22–25.
22. Maurice E Stucke, ‘Behavioral Antitrust and Monopolization’ (2012) 8(3) Journal of Competition Law & Economics 545, 558–565.
23. Khan (n 5) 745–756.
24. OECD, ‘Dark Commercial Patterns’ (OECD Digital Economy Papers No 336, October 2022) 9–11 https://doi.org/10.1787/44f5e846-en accessed 11 May 2026.
25. Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector (Digital Markets Act) [2022] OJ L265/1, art 5(2) and art 13(4).
26. Pieter Larouche and Alexandre de Streel, ‘The European Digital Markets Act: A Revolution Grounded on Traditions’ (2021) 12(7) Journal of European Competition Law & Practice 542, 543–545.
27. Herbert Hovenkamp, ‘The Looming Crisis in Antitrust Economics’ (2021) 101 Boston University Law Review 489, 496–500.
28. DMA (n 25) recital 13 and art 5(2).
29. Australian Competition and Consumer Commission, Digital Platforms Inquiry — Final Report (June 2019) ch 7 https://www.accc.gov.au/system/files/Digital%20platforms%20inquiry%20-%20final%20report.pdf accessed 11 May 2026.
30. ACCC (n 29) recommendations 16–18.
31. Case No 39 of 2018 Umar Javeed and Others v Google LLC and Others (Competition Commission of India, Order under Section 27, 20 October 2022).
32. ibid paras 374–388.
33. Khan (n 5) 783–790.
34. Crémer, de Montjoye and Schweitzer (n 19) 73–77.
35. Larouche and de Streel (n 26) 545–547.
36. Cohen (n 3) 18–20; Khan (n 5) 792–796.