Regulatory Capture by Design: How Big Tech Locks the Door Behind Itself

The first act is the most visible. A startup identifies an industry protected by regulation (taxis, hotels, banking, media) and simply ignores those rules. It grows fast enough that by the time regulators respond, the company has millions of users who would be inconvenienced by a shutdown.

Uber is the textbook case. The company launched ride-hailing services in city after city without taxi medallion licenses, without the insurance requirements that applied to existing operators, and without the background check standards that regulators had imposed on traditional taxi companies. As legal scholar Elizabeth Pollman and Jordan Barry documented in the University of Chicago Business Law Review, these “regulatory entrepreneursA company that deliberately violates existing laws to build market share rapidly, then leverages its scale to pressure lawmakers into creating favorable new rules.” deliberately operate in legal gray zones, then leverage public popularity to pressure lawmakers into favorable outcomes. Uber CEO Travis Kalanick described market entry as running “a political campaign and the candidate is Uber.”

The strategy worked because it exploited a genuine asymmetry: regulation moves slowly, technology moves fast, and by the time a city council convenes a hearing, hundreds of thousands of residents are already using the app. In Portland alone, Uber and Lyft deployed 16 lobbyists in 2015, representing 30 percent of all lobbying activity in the city that year. The implicit message was clear: ban us if you dare, but your constituents will notice.

Airbnb followed the same script with short-term rentals. It did not seek hotel licenses. It built demand first, created a user base that would fight for it, and then negotiated from a position of strength. The pattern has repeated with e-scooter companies, cryptocurrency exchanges, and generative AI platforms.

The first act exploits what economists call regulatory lagThe structural delay between a new business model or technology emerging and regulators developing a framework to govern it, often exploited by fast-moving companies.: the structural delay between a new business model emerging and regulators developing a framework to govern it. In a market where network effects create winner-take-most dynamics, this lag is not a bug in the system. It is the system.

Uber provides the clearest illustration. The company launched without taxi medallion licenses, ride-for-hire insurance, or mandated background checks, operating in defiance of existing regulatory frameworks in dozens of cities simultaneously. The University of Chicago Business Law Review published an analysis of this phenomenon under the title “Lawbreaking as Lawmaking,” documenting how companies deliberately violate existing rules to force regulatory renegotiation from a position of installed-base power. Travis Kalanick described each market entry as running “a political campaign and the candidate is Uber.”

The mechanism relies on several reinforcing dynamics. First, network effects ensure rapid adoption. Second, user dependency creates political risk for regulators who might shut down the service. Third, the company’s scale generates lobbying resources. In Portland, Uber and Lyft deployed 16 lobbyists, representing 30 percent of all lobbying activity in the city in 2015. When Austin, Texas attempted to impose fingerprint-based background checks, Uber and Lyft reportedly spent over $8 million on a referendum campaign. They lost that particular battle but won the broader war: within four years, 41 state legislatures had passed industry-friendly frameworks, often using model legislationPre-drafted bills written by industry groups or affiliated organizations and introduced by sympathetic lawmakers as if they originated through the normal legislative process. provided by the companies themselves.

Airbnb, cryptocurrency exchanges, and generative AI platforms have all followed variations of this playbook. The common denominator: move faster than the regulatory apparatus, build a user base that doubles as a political constituency, then negotiate the rules from a position no startup competitor will ever occupy again.

The pivot from “don’t regulate us” to “please regulate us” is the most telling moment in the playbook. It signals that the company believes it has won enough market share to survive compliance costs that its competitors cannot.

In March 2019, Mark Zuckerberg published a Washington Post op-ed calling for governments to impose stricter regulation on internet platforms, covering harmful content, election integrity, privacy, and data portability. This was the same company that had spent years fighting the EU’s General Data Protection Regulation. As the Electronic Frontier Foundation pointed out, “Facebook was able to achieve its current size thanks in part to a lack of data privacy laws in its early days.” Imposing those same rules now, the EFF argued, would “put would-be competitors at a disadvantage that Facebook never had to overcome.”

The pattern repeated in 2023 when OpenAI CEO Sam Altman testified before Congress and proposed a federal licensing regime for “powerful” AI models. The proposal sounded responsible. Critics, including Hugging Face CEO Clem Delangue, pointed out that such licensing would “further concentrate power in the hands of a few” and “solidify [OpenAI’s] first-past-the-post position, while constraining newer entrants.” Techdirt’s headline captured the skepticism: “Sam Altman Wants the Government to Build Him a Moat.”

In both cases, the CEO of a dominant company appeared before legislators with a message of humility and responsibility. In both cases, the proposed regulations would have imposed costs that the proposer could afford and that smaller competitors could not.

The pivot is the strategic core of the playbook, and it depends on a specific asymmetry: the company calling for regulation has already absorbed the R&D and infrastructure costs that compliance requires. For competitors who haven’t, those same costs function as a barrier to entry.

Mark Zuckerberg‘s March 2019 Washington Post op-ed called for regulation across four domains: harmful content, election integrity, privacy, and data portability. The Mercatus Center at George Mason University noted that Facebook had already built content moderation infrastructure that competitors lacked, meaning standardized requirements would asymmetrically burden smaller platforms. The EFF was blunter: “Zuckerberg’s vision for Internet regulation prioritizes Facebook’s business interests above those of its potential competitors.”

The same dynamic emerged in AI. When Sam Altman proposed federal licensing for powerful AI models in his May 2023 Senate testimony, the timing was not coincidental. A leaked Google memo had just acknowledged that open-source AI models were rapidly closing the gap with proprietary ones. A licensing regime that defined “powerful” models by capability thresholds would create a regulatory moat precisely when the technological moat was eroding. Hugging Face CEO Clem Delangue argued the proposal would “further concentrate power in the hands of a few.”

The mechanism is what economists call regulatory captureThe process where a regulated industry shapes the legislation meant to regulate it, often resulting in rules that benefit the industry more than the public interest. by invitation. Rather than waiting for regulators to impose rules (which might target the incumbent’s actual abuses), the dominant firm preemptively shapes the regulatory framework around compliance requirements it has already met. The result is a system that looks like consumer protection but functions as incumbent protection.

The final act is the quietest and the most consequential. Once regulations are in place, they create ongoing compliance costs that fall disproportionately on smaller firms, effectively converting public law into a private competitive advantage.

GDPR is the most studied example. Research published by CEPR (Centre for Economic Policy Research) found that while the regulation reduced profits by an average of 8 percent for firms targeting EU markets, large technology companies experienced no significant reduction in profits or sales, while small IT companies saw profit impacts double the average. Companies like Facebook, Google, and Apple continued to grow and add customers.

The competitive effects were stark. Analysis of the advertising technology market showed that the smallest tier of adtech vendors (ranked 100 to 150) lost an average of 31.86 percent of their market share in the months following GDPR’s activation, while Google’s market share increased. Advertisers shifted spending toward platforms they trusted to handle compliance, which meant the platforms that already had compliance infrastructure: the incumbents.

The EU AI Act shows signs of repeating the pattern. Compliance costs for small and medium-sized enterprises deploying high-risk AI systems are estimated at hundreds of thousands of euros for initial implementation alone, with annual maintenance costs that represent a significant burden on smaller firms’ profit margins. Industry groups have reported that many EU and UK tech startups and SMEs face delayed access to frontier AI models under the new framework.

The third act converts regulatory compliance into a fixed cost, which by definition advantages firms with higher revenue over which to spread it. This is not a side effect. It is the mechanism.

GDPR provides the most empirical evidence. CEPR research found an average 8 percent profit reduction across EU-targeting firms, but the distribution was sharply uneven: large technology companies saw no significant impact on profits or sales, while small IT firms bore profit reductions double the average. Facebook reportedly hired approximately 1,000 compliance staff globally, a cost that barely registered against quarterly revenues exceeding $20 billion but would be existential for a 50-person startup.

The market concentration data tells the story. In the advertising technology sector, the smallest tier of adtech vendors lost an average of 31.86 percent of their market share in the months following GDPR activation, while Google’s share rose. Websites dropped smaller ad-tech vendors, consolidating around the platforms that could credibly demonstrate compliance. The regulation designed to constrain data monopolies measurably strengthened them.

The EU AI Act is following the same trajectory. Compliance costs for SMEs deploying high-risk systems are estimated at hundreds of thousands of euros for initial implementation, with annual costs that represent a significant burden on profit margins. A pattern identified by analysts at the Foundation for Economic Education applies here too: “A high-regulation environment is an anti-startup, anti-entrepreneurial environment,” not because regulation is inherently wrong, but because compliance scales with revenue while its costs do not.

The result is a market where the regulatory framework functionally subsidizes incumbents. New entrants must match the compliance infrastructure of billion-dollar companies before earning their first dollar. The door is not merely closed; it is locked, and the key is labeled “consumer protection.”

The playbook works because it exploits a genuine tension in democratic governance. Legislators face real pressure to regulate harmful technologies, and the companies offering to help write the rules are, in fact, the entities that understand those technologies best. The alternative, writing rules without industry input, risks producing legislation that is technically illiterate and practically unenforceable.

This creates what might be called the expertise trap. The companies most qualified to advise on regulation are the ones with the most to gain from shaping it. And because the harms of bad regulation (reduced competition, higher barriers to entry, market concentration) are diffuse and long-term, while the harms of no regulation (data breaches, algorithmic manipulation, platform abuse) are visible and immediate, the political incentive always favors action, even captured action.

Uber and Lyft together now have more lobbyists than Amazon, Microsoft, and Walmart combined. That is not because ride-hailing is more complex than cloud computing or global retail logistics. It is because the companies recognized early that the regulatory environment was the competitive battlefield, and they staffed accordingly.

The structural explanation is information asymmetryA situation where one party in a transaction has more or better knowledge than the other, allowing the informed party to gain advantages at the expense of the less informed party. compounded by temporal asymmetry. Legislators face genuine public pressure to act on technology harms (data breaches, algorithmic manipulation, platform user intent override). The companies most capable of explaining the technical landscape are the same companies with the strongest incentive to shape regulation in their favor. This is the classic conditions for regulatory captureThe process where a regulated industry shapes the legislation meant to regulate it, often resulting in rules that benefit the industry more than the public interest., as described by economist George Stigler in 1971: regulated industries tend to capture their regulators because the concentration of interest on the industry side exceeds the diffuse interest on the public side.

But the tech version adds a temporal dimension Stigler did not anticipate. Because digital markets exhibit strong network effects and winner-take-most dynamics, first-mover advantage in the regulatory cycle compounds first-mover advantage in the market. A company that achieves scale before regulation arrives not only has the resources to influence the rules; it has the installed base that makes alternative regulatory approaches politically costly.

The lobbying infrastructure reflects this understanding. Uber and Lyft together deploy more lobbyists than Amazon, Microsoft, and Walmart combined. In four years, they convinced 41 state legislatures to adopt industry-friendly frameworks, often using model legislationPre-drafted bills written by industry groups or affiliated organizations and introduced by sympathetic lawmakers as if they originated through the normal legislative process. the companies had drafted. This is not corruption in the crude sense. It is strategic investment in the regulatory environment as a competitive moat, more durable than any technology advantage because regulation, once enacted, persists long after the market conditions that justified it have changed.

If the problem is that incumbents shape regulation to exclude competitors, the solutions need to target the mechanism, not just the symptoms.

First, compliance costs could be scaled to company size. GDPR applies roughly the same requirements to a ten-person startup and a trillion-dollar platform. A tiered framework, where requirements escalate with revenue, user base, or market share, would preserve consumer protection without functioning as a barrier to entry.

Second, regulatory agencies need independent technical expertise. As long as legislators depend on the companies they regulate for technical guidance, the expertise trap will persist. Publicly funded technical advisory bodies, modeled on institutions like CERN or the National Academies of Science, could provide the knowledge base that currently comes with strings attached.

Third, sunset clausesA provision in a law or regulation that causes it to automatically expire after a set period unless legislators actively vote to renew it.. Regulation designed for a market dominated by three companies may not be appropriate five years later when the technology has matured and the competitive landscape has shifted. Mandatory review periods would prevent regulations from ossifying into permanent incumbent protection.

None of this is simple. But the current pattern, where the biggest companies in history help write the rules that govern their industries, and those rules consistently make it harder for anyone else to compete, is not an accident. It is a strategy. And recognizing it as such is the first step toward countering it.

If the mechanism is fixed compliance costs functioning as regressive barriers, the interventions must target cost structure, information asymmetryA situation where one party in a transaction has more or better knowledge than the other, allowing the informed party to gain advantages at the expense of the less informed party., and regulatory persistence.

Tiered compliance frameworks. GDPR applies substantially similar requirements to a ten-person startup and a trillion-dollar platform. Revenue-indexed or market-share-indexed compliance tiers would preserve the consumer protection objective while eliminating the disproportionate cost burden. The EU AI Act’s SME exemptions gesture toward this, but the carve-outs are narrow and the base costs remain prohibitive.

Independent technical capacity. Regulatory captureThe process where a regulated industry shapes the legislation meant to regulate it, often resulting in rules that benefit the industry more than the public interest. via expertise depends on regulators lacking in-house technical knowledge. Publicly funded advisory bodies with rotating membership (excluding active industry executives) could break the dependency. The model exists in other domains: pharmaceutical regulation relies on independent reviewers, not on pharmaceutical companies writing their own safety standards.

Mandatory sunset and review clauses. Regulation designed for a market with three dominant players becomes incumbent protection when the underlying technology matures. Five-year mandatory reviews, with burden of proof on continuation rather than repeal, would prevent regulatory frameworks from outliving their justification.

Pre-regulation competition impact assessments. Just as environmental impact assessments are required before major construction, proposed regulations above a cost threshold should require an independent analysis of competitive effects, specifically whether the framework would increase or decrease market concentration.

The deeper challenge is political. Companies deploying this strategy are not breaking laws; they are using the lawmaking process itself as a competitive tool. The response requires not just better regulation, but a structural recognition that the entities lobbying hardest for regulation may be the ones who benefit most from it. When the fox asks for a henhouse, the appropriate response is not gratitude. It is suspicion.