At a time when the Rencontres de l’intelligence économique de défense (RIED 2025–2026) is taking place and the Directorate General of Armaments (DGA) is conducting work on the European Defence Technological and Industrial Base (EDTIB) and industrial sovereignty, with a view to considering better coordination between defence stakeholders as well as the concept of strategic autonomy, Net Assessment appears to be a relevant approach for assessing the economic impact of the General Data Protection Regulation (GDPR) that has been imposed on businesses since 2018. This foresight method could measure the structural effects of the GDPR on the concentration of a market worth over €70 billion.
Measuring structural effects in the era of RIED and industrial sovereignty
The launch of the first cycle of the Defence Economic Intelligence Meetings (RIED) in the fall of 2025 marked a new milestone in strategic thinking on defence economic intelligence, economic security and the structuring of the European defence industrial base (BITD). The work undertaken reflects a clear desire to put industrial sovereignty back at the heart of public decision-making. This dynamic, driven in conjunction with the DGA and its dedicated defence economic intelligence unit, nevertheless raises a methodological question that is rarely explicitly formulated: how can we assess whether a decision actually alters the industrial balance of power?
This is precisely what the Net Assessment method enables, a method developed by Andrew Marshall within the US Department of Defence’s Office of Net Assessment in 1973. The principle is simple, yet demanding: what matters is not an actor’s absolute performance, but the evolution of the relative gap separating them from their competitors. A decision becomes strategic when it permanently alters this gap. Applying this approach leads us to observe not only the intentions of a public policy, but its cumulative effects over time. The case of the GDPR serves to illustrate this mechanism.
The GDPR and digital market concentration: a cumulative drift
In 2017, the European digital advertising market was worth €48 billion, according to IAB Europe. Furthermore, it was experiencing double-digit annual growth of 13.2%¹. At that time, Google and Facebook accounted for around 60% of this market, and up to 70% in certain search and mobile segments1 .
Then came May 25th 2018, the date on which the GDPR imposed a regulatory framework for data processing on businesses2. The obligations of the GDPR introduced a new layer of complexity. Indeed, the regulation defined concepts such as explicit consent, full traceability, continuous documentation of processing activities, and exposure to fines of up to 4% of global turnover3. For Alphabet, whose revenue exceeded $110 billion in 20184, this theoretically means a fine of over $4 billion in the event of non-compliance. For Meta, which generated approximately $56 billion in revenue in the same year5, the cost of compliance could exceed $2 billion. However, in practice, the issue is not the maximum penalty, but rather the structural cost of compliance. Indeed, this entails a fundamental overhaul of the organisation, including the redesign of systems, the adaptation of data flows, the employment of specialist lawyers, ongoing audits, and the review of partner contracts. For groups with high operating margins and massive reserves, these adjustments are manageable, even if they merely slow the company’s growth rather than destabilising it. For players whose turnover is twenty or fifty times lower, the relative burden of compliance is far heavier.
Furthermore, in 2019, Google and Facebook alone accounted for 75.8% of the French online advertising market, representing approximately €4.4 billion in advertising revenue. Specifically, Google held nearly 50% of the market, whilst Facebook controlled around 25%. In a total market worth €5.9 billion, a five-point gain in market share represented, at that time, nearly €300 million in additional annual revenue. This quasi-duopoly was all the more pronounced given that Google and Facebook captured 92% of the growth in the digital advertising market between 2016 and 2017. This illustrates the strengthening of their power across the entire market and the sidelining of other players in the sector6 who “share the scraps”.
To illustrate this concentration, it is useful to refer to the Herfindahl–Hirschman Index (HHI), which measures market concentration. For the digital advertising market in 2016, the HHI was already above 3,000 points. Indeed, with a combined market share of 71.2%, Google and Facebook held a dominant position well above the thresholds typically used to identify a highly concentrated market. This indicator confirms the strengthening of a quasi-duopolistic structure in online advertising7 .
Furthermore, the Net Assessment approach allows us to focus on the trajectory rather than on isolated events. It is therefore appropriate to observe the market’s evolution following the companies’ compliance. Between 2020 and 2022, the European digital advertising market experienced strong growth despite the pandemic and the unfavourable macroeconomic context. It rose from around €69 billion in 2020 to nearly €92 billion in 2021, before stabilising at around €86 billion in 2022 (IAB Europe AdEx 2020–2022).
Despite these fluctuations, the market structure remains highly concentrated, with the majority share captured by large digital platforms and a high level of concentration characteristic of a market dominated by a limited number of key players.
It would be simplistic to attribute all of this dynamic solely to the GDPR. Indeed, the very characteristics of this market, which combines network effects, vertical integration and the financial clout of major platforms, play a decisive role in this trend towards concentration. However, the regulation has added an additional structural constraint which, in an already asymmetric environment, tends to strengthen those with the capacity to absorb it.
The lessons drawn from the GDPR case are relevant beyond digital markets. They show that a regulatory decision with systemic impact can permanently alter a market’s structure. It can increase concentration, strengthen players with high absorption capacity and reduce the room for manoeuvre of more vulnerable players.
Regulatory architecture, the European BITD and strategic implications
In the context of the RIED 2025–2026, the work on defence economic intelligence and discussions regarding the European BITD, this observation takes on particular significance. Future regulatory frameworks, whether concerning cybersecurity, sovereign cloud computing, dual-use technologies or the regulation of industrial data, will also produce asymmetric effects. Several strategic questions therefore arise: which industrial sectors have sufficient depth to absorb increasing complexity? Which players will see their relative advantage consolidated by the introduction of new requirements? Where are the tipping points likely to permanently alter the competitive balance?
Net Assessment reinforces the analytical requirements of economic intelligence as applied to the defence sector. It offers a way to compare trajectories, identify relative gaps and incorporate the cumulative dimension into decision-making. At a time when industrial sovereignty and economic security are shaping the work of the DGA and the Rencontres de l’intelligence économique de défense, understanding the differentiated effects of regulatory frameworks appears essential. Standards should no longer be viewed merely as a legal framework, but also as a lever for sustainable industrial reconfiguration.
Part of contemporary economic power lies in the silent gaps between the standard and its application, which is precisely what the Net Assessment reveals.
Download the Opinion
- IAB Europe (2018). “European Digital Advertising market has doubled in size in 5 years”. https://iabeurope.eu/european-digital-advertising-market-has-doubled-in-size-in-5-years/. ↩︎
- Government. (2025). The General Data Protection Regulation (GDPR): A Guide. https://www.economie.gouv.fr/entreprises/gerer-son-entreprise-au-quotidien/assurer-sa-cybersecurite-et-la-protection-de-ses/le ↩︎
- Ibid. ↩︎
- Garganne, S. (2018). Alphabet surpasses the 100 billion mark in turnover, but its results are disappointing. Le Figaro. https://www.lefigaro.fr/secteur/high-tech/2018/02/02/32001-20180202ARTFIG00161-alphabet-passe-la-barre-des-100-milliards-de-chiffre-d-affaires-mais-ses-resultats-decoivent.php ↩︎
- Meta Platforms Revenue 2012–2026 | META. (2026). MacroTrends. https://www.macrotrends.net/stocks/charts/META/meta-platforms/revenue ↩︎
- Government. (2020). Online advertising:
for a level playing field. https://www.igf.finances.gouv.fr/files/live/sites/igf/files/contributed/Rapports%20de%20mission/2020/2020-M-039-04_PUB_internet-VPUBLIQUE.pdf ↩︎ - Entner, R. (2017), Digital advertising takes the lead – Dominated by Google and Facebook, Recon Analytics, 30 May 2017 ↩︎
