Antitrust moves in years; vendor dependency is set at signing
The Justice Department’s search case opened a long fight over platform power. For regulated buyers it offered no relief on their own concentration risk, which is decided in contracts, architecture and tested exit plans on a timeline no court can match.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On October 20, 2020, the U.S. Department of Justice, joined by a group of state attorneys general, sued Google, alleging that it unlawfully maintained monopolies in general search and search advertising. A central part of the complaint concerned default placement agreements: payments to device makers and browser developers to make Google the preset search engine. It was the largest U.S. monopolization case against a technology company since the Microsoft litigation around the turn of the century. Weeks later, in December, the Federal Trade Commission and a coalition of states filed separate suits against Facebook. For a few months, platform power was the central topic of technology policy.
When a government sues a dominant technology company, buyers are tempted to read it as relief on the way: more competition, better prices, a stronger hand at renewal. For banks, health systems and agencies that reading was mostly wrong in 2020 and is mostly wrong now. Antitrust addresses the structure of markets over many years. A regulated institution’s concentration risk is about whether it can keep operating, and switch, if a provider fails or changes terms. We look at three questions in turn: what antitrust can and cannot do for a buyer, where concentration actually affects a regulated institution, and which levers sit with the buyer.
What antitrust can and cannot do for a buyer
Monopolization cases are slow by design. The government has to prove market power and conduct that maintains it. Then comes a separate fight over remedies, then appeals. The search case was filed in October 2020. A liability ruling came in August 2024 and a remedies decision in September 2025. That is a full technology generation, during which most institutions renewed their major contracts at least once.
Remedies, when they come, target conduct in a specific market: exclusive deals, default placements, sometimes data access for rivals. They rarely change the terms an individual customer already signed. They do not lower the cost of moving years of data, integrations and staff skills off a platform. A bank’s dependence on a cloud provider, or a health system’s on its electronic record vendor, is mostly not the kind of dependence antitrust reaches.
Where concentration affects a regulated institution
Concentration shows up in four distinct forms, and each needs its own evidence.
- Operational dependency. One provider whose outage stops a critical service. Evidence: recovery time objectives tested against a provider outage, not only against the institution’s own failures.
- Commercial dependency. Renewal terms that worsen because the buyer cannot credibly leave. Evidence: price history across renewals and a current estimate of switching cost.
- Data dependency. Records held in formats or services that are costly to extract. Evidence: a recent test export of a critical dataset, with time and completeness measured.
- Skills dependency. Teams trained on one ecosystem, so switching means retraining as well as migrating. Evidence: an honest count of staff who could run an alternative.
Supervisors focus mainly on the first form. They care increasingly about the others, because those decide whether an exit plan is real. The U.S. banking agencies set out expectations for third-party relationships, including contingency and termination planning, in interagency guidance in 2023. European and UK regimes went further and created direct oversight of critical technology providers to the financial sector. Health care has no single equivalent, though the 2024 attack on a major claims clearinghouse made the operational point in practice.
Which levers sit with the buyer
None of the levers that matter waits for a court.
Contract terms. Data return in usable formats, transition assistance at agreed rates, notice periods for material changes, audit rights and clear termination rights are all negotiated at signing, when bargaining power is highest. They are much harder to win at renewal, after implementation has sunk the switching cost. Organizations should check with counsel on what their regulators expect these clauses to cover.
Architecture. Dependency is cheaper to manage when the parts of a system with durable value stay portable. Those parts are data models, identity, integration logic and records. Commodity services can be provider-specific without much risk. Not everything needs to be multi-cloud or multi-vendor, and pursuing that everywhere is expensive. The choice should be made service by service, by criticality.
A tested exit plan. Many exit plans have never been exercised. A credible plan names the target platform, estimates time and cost, and has been partly tested. Restoring a critical dataset outside the primary provider, or running one key workflow on an alternative for a day, turns assumptions into measurements. Untested plans tend to underestimate effort.
Default placement, the heart of the search case, has a parallel inside the enterprise. Many institutions made their most consequential platform choices by default: the identity service bundled with the productivity suite, the analytics tool included with the cloud agreement, the security add-on enabled at renewal. Defaults are convenient. They also accumulate into dependencies nobody chose. A yearly review of which bundled defaults now support critical services costs little and is usually revealing.
Procurement teams can also use competition where it exists. In most categories regulated buyers depend on, credible alternatives exist at initial purchase. That bargaining power fades after implementation. The effort is better spent on portability and exit terms during selection than on discounts that deepen the lock-in.
Large platforms often offer better security and resilience than an institution could build alone. The benefits of scale and the risks of dependency arrive together, and only the buyer can manage the second. A court can change how a dominant firm behaves in its markets. It cannot tell a credit union, a hospital or a state agency how long it would take to move its core records.
With hindsight
The search case reached a liability ruling in August 2024, when a federal judge found that Google had unlawfully maintained a monopoly in general search. The remedies decision in September 2025 stopped well short of a breakup. It declined to order a sale of the Chrome browser, barred exclusive distribution arrangements and required some sharing of data with rivals. A separate federal case on advertising technology produced a ruling against Google in April 2025.
None of this changed the day-to-day position of a bank or health system buying cloud, productivity or analytics services. Supervisory attention to concentration did change, through third-party risk guidance in the U.S. and dedicated regimes for critical providers in Europe and the UK. The 2020 suit is a useful reminder that market structure is a policy question, while dependency is a management one that each institution owns.