Restrictions on data flows have concentrated power inside the largest platforms
In 2025, Meta passed $200.97 billion in revenue for the first time, pushing cumulative revenue since its 2012 listing beyond $1 trillion. The company achieved it by turning human attention into performance advertising at industrial scale, even as regulators, browser makers, and platform owners steadily narrowed the channels through which that attention could be tracked, priced, and sold. The contradiction now sits at the center of the digital economy: the more aggressively governments and platforms move to restrict data flows, the more power accrues to the companies already large enough to survive without them.
That concentration has unfolded through thousands of technical decisions hidden behind consent banners and browser settings. Cookies, device identifiers, browser types, and language settings can be stored or read on devices to recognize users each time they connect to a service. Advertising profiles reflect activity across websites and apps, including forms users submit and content they look at. Those profiles are then used to present advertising that appears more relevant. The same infrastructure increasingly governs editorial visibility as well: content personalization profiles can reflect user activity across services, while content order can be adapted so users more easily find non-advertising content matching their interests. The distinction between advertising infrastructure and information infrastructure has become harder to locate.
European regulators attempted to interrupt that system with the GDPR, which was constructed to homogenize data protection laws across EU member states and give individuals greater control over personal data while holding organizations more accountable. Enforcement since 2018 brought significant changes to data protection practices, including mandates that organizations implement data protection measures from the outset of system and product development and notify supervisory authorities of breaches threatening individuals’ rights. Yet the market consequences cut in directions lawmakers did not fully anticipate. A Centre for Economic Policy Research discussion paper found that data protection laws reduced third-party tracking cookies while driving a corresponding surge in first-party cookies. In the same study, GDPR boosted Google market share.
Control over operating systems and browsers now determines who benefits from privacy enforcement
The mechanics behind that shift were already visible inside mobile advertising. Apple unilaterally changed the ability of apps to track behavior on iPhones, and the quality of Meta advertising fell significantly. Advertisers shifted a tiny amount of budget away from Meta, but smaller businesses absorbed the deeper damage because customer acquisition costs rose for firms with fewer alternative channels. Apple, meanwhile, occupied both sides of the trade. Its own advertising business grew while Meta’s weakened, because the company controlled the privacy architecture governing its competitors. Privacy regulation increasingly rewards whoever owns the operating system, browser, retail platform, or login relationship.
Google’s Privacy Sandbox reflects the same realignment. The initiative aims to create a “more private and secure web” by phasing out third-party cookies and replacing them with systems that group users into large cohorts based on browsing behavior. Critics argued the changes threatened ad revenue without fully addressing privacy concerns, but the commercial logic runs deeper than advertising efficiency. Larger apps may view third-party data as less useful because they already possess enormous stores of first-party information, while smaller apps consider that external data more beneficial. Once cross-site identifiers disappear, scale itself becomes the targeting advantage.
That advantage now extends beyond advertising into artificial intelligence infrastructure. Microsoft, Alphabet, Amazon, and Meta committed $650 billion to AI investment, a spending surge Gartner described as part of an “Intelligence Supercycle” realigning markets. Yet the economics underneath the boom have started to strain. Analyst projections warn big tech free cash flow could drop up to 90% in 2026 because capital expenditure is outpacing revenue growth from AI spending. Even Gartner’s own marketing research shows many CMOs becoming disillusioned with AI’s promise as innovation outruns measurable returns. Companies that spent a decade converting user surveillance into cash now face the opposite problem: converting cash into profitable intelligence systems.
The infrastructure race is forcing the winners of surveillance capitalism into a new financial burden
No company illustrates the tension more sharply than Oracle. By securing capacity deals with OpenAI and xAI, Oracle transformed itself into a major data-center infrastructure provider. But its data-center buildout is stretching financial capacity. The company recently raised fiscal 2026 capex to $50 billion from $35 billion in a single quarter, a jump tied to OpenAI-related demand. The infrastructure race increasingly resembles an arms buildup financed before the commercial model has stabilized.
Meanwhile the advertising system that funds much of the digital economy keeps migrating toward companies with direct control over consumer transactions. Analysts project retail media will surpass linear TV advertising by 2028 and reach $100 billion in the US alone. Retail media will displace traditional display advertising because purchase decisions occur on digital shelves owned by retailers themselves. Brands now allocate budgets to rent visibility inside ecosystems that already possess payment histories, loyalty data, and closed-loop attribution. The open web loses leverage each time advertising migrates into a storefront.
That migration leaves smaller publishers and independent ad-tech firms trapped between regulatory pressure and platform consolidation. The AdTech market overall is still projected to reach $1.496 trillion by 2030, with players ranging from Meta and Google to The Trade Desk, Criteo, and Magnite. But the industry’s own identity systems are deteriorating. Google Chrome’s plan to deprecate cookies, alongside Apple’s identifier changes, forced digital advertising to reconsider the future of identity. The sector once took identity solutions for granted, relying on abundant third-party cookies to power attribution and targeting. Now even attribution itself — the process of identifying steps users take before converting — is becoming proprietary infrastructure controlled by the largest platforms.
Compliance costs increasingly reinforce the dominance privacy law was meant to limit
The political response is widening from privacy into cybersecurity and age verification. In January 2026, the European Commission published the Cybersecurity Act 2 proposal, which would replace the existing 2019 framework and address supply-chain risks alongside rising cyberattacks. The proposal strengthens ENISA and introduces a new approach to ICT supply-chain security, while future certification frameworks may expand beyond products to include organizational cybersecurity practices. At the same time, European guidelines recommend age-verification measures for adult content and age-restricted social media use, alongside privacy-preserving systems that confirm age without disclosing additional personal information. Every additional compliance layer favors firms large enough to absorb verification, certification, and infrastructure costs internally.
The irony is that privacy regulation designed to weaken surveillance capitalism increasingly entrenches the companies best positioned to practice it at scale. Economic arguments have become central to the debate around privacy, and references to the economic value of personal data have become common in policy and regulation. Alessandro Acquisti warned that the success of the economics of privacy laid the foundation for adverse effects on public debate around privacy. Markets translated privacy into a solvable optimization problem. The largest platforms translated it into a moat.
Now the burden shifts to balance sheets. The companies that benefited most from tighter control over identity — the operating systems, cloud providers, retail platforms, and browser owners — also carry the cost of financing the infrastructure required to preserve that dominance. Their advantage no longer rests primarily on collecting more data than rivals. It rests on owning the systems through which everyone else must ask permission to use it.
