8.2.1 Application Functionality Through Data-Driven Supply Chains

With a typical supply chain model, a client application (often accessed through a lower-powered device) makes requests to a server through an Application Programming Interface (API). The server – usually in a data centre – processes the request and responds with the result, which the client displays, uses for functionality, or inputs to another service for further processing. One actor (a customer) can control the client, while another (a provider) performs the computation. Data flow links actors’ systems and enables the functionalities they produce. This allows expensive computing resources to be centralised, with costs spread across a provider’s customer base and customers paying based on usage or subscription (or some combination thereof). Some providers’ data centres work at hyperscale, where computing resources rapidly grow and shrink in response to demand.

Through this, hardware resources and software capabilities are modularised into plug-and-play services, with vendors coordinating their integration into a coherent application. This application may itself be a cloud service working as a component in other applications, with the vendor accordingly being a provider to their own customers. As supply chains comprise multiple applications and services with their own supply chains, coordinated by different actors, no single party has overall control. Moreover, each instance of a supply chain may differ in composition and structure: data’s processing determines the direction of its subsequent flow through the chain (going to different actors depending on the result) and therefore the actors involved.Footnote ¹⁹ However, companies and organisations typically have ongoing legal, technical and economic relationships across chains. As such, while chains may differ with each instance, they broadly follow patterns reflecting these more persistent relationships, taking a particular pattern – or combination of patterns – each time. Supply chains thus involve services and applications dynamically strung together and linked by data flows – each potentially with their own supply chain – which may support many types of service, application or functionality and serve multiple customers and purposes simultaneously.

8.2.2 Data-Driven Supply Chains and Data Production

Platformisation – as a process of platforms replacing markets – involves capture as described by Agre,Footnote ²⁰ whereby human activities are (re-)configured to make them legible and trackable by and with computers.Footnote ²¹ As Poell et al argue, platform relations are ‘organised through the systematic collection, algorithmic processing, monetisation, and circulation of data’.Footnote ²² This produces social and economic interactions represented, according to Cohen, by ‘structured flows of data suitable for continuous collection and analysis at the platform level’.Footnote ²³ Agre characterisesFootnote ²⁴ capture as a complex process by which activities are broken down into their component parts, reconceptualised to permit datafication and re-constructed accordingly to enable computerised control – allowing (as Cohen puts it) the platform to serve its own priorities.Footnote ²⁵

A key feature of informational capitalism is that data and other intangible informational resources are reconceptualised as property and commodified.Footnote ²⁶ Indeed, the production and processing of data generates significant revenue for platform companies, while datasets are extensively traded between a vast array of data brokers and widely leveraged for profit. The datafication found in capture therefore operates as the ‘principal logic of commodification’ in informational capitalism,Footnote ²⁷ whereby social and economic relations reconfigured around platforms are represented in data, commodified and put to work in platform business models. While, as Cohen argues, platforms represent points of ‘friction’ in networksFootnote ²⁸ – in that social and economic relations must pass through them – capture thus permits frictionless value extraction by platform providers.

This involves complex patterns of data production and flow – not just around ‘a platform’, but between a variety of platforms and services controlled by multiple actors who may together produce an application, its functionalities and its effects, and through which significant data may be extracted. As such, supply chains are important infrastructures for data production, both for AI production and developmentFootnote ²⁹ and for tracking, profiling and targeting. Data produced through supply chains feeds into social sorting systems for making decisions about people’s lives in the private sector; and in eligibility assessments for welfare, housing or other public services. This is all enabled by supply chains stretching across societies: producing, transporting and processing data; linking actors and their systems; and giving effect to decisions, outcomes and functionalities.

In digital advertising, supply chains are extensive.Footnote ³⁰ Trackers produce dataFootnote ³¹ for profiling, bidding and targeting systems,Footnote ³² which is widely processed and traded.Footnote ³³ Flows of data through these chains link audiences, advertisers, and many ad brokers, ad exchanges and data brokers. Advertising chains are often comingled with others – a mobile app might integrate trackers from multiple companies,Footnote ³⁴ or use component services which themselves integrate trackers, while displaying targeted advertising for revenue purposes. The technologies which underpin application functionality therefore often also produce data through tracking systems and spirit it away to targeting processes.

8.2.3 Data-Driven Supply Chains and Informational Capitalism

Supply chains thus have a dual role: working to produce application functionality, and to produce and extract data and enable targeting. Reorganising social and economic life around platforms and supply chains therefore means reorganising around infrastructures for data’s production, aggregation and use. This data – relating both to the markets reconstituted around supply chains and to the interactions of individuals and groups – is subject to ‘active appropriation strategies’Footnote ³⁵ (as Cohen says) by providers seeking competitive advantage. Data-driven supply chains are therefore how various platforms are constructed, how certain platforms are strung together to construct others, and how much of social and economic life has been capturedFootnote ³⁶ by the logics and imperatives of profit extraction under informational capitalism.Footnote ³⁷

As such, supply chains are key infrastructures in informational economies. With the reorganisation of markets and social relations around platforms, and of platforms around supply chains, data and its flow plays an important structural role in addition to its propertisation and commodification.Footnote ³⁸ Data’s flow links actors to produce applications’ functionalities and enables their platformised relations. Data’s processing determines which actors take part in each instance. Given data’s structural and economic importance, asymmetries in the ability to produce and productively use data affect the position and power of various actors. Those with greater capacity to construct platforms and provide services by doing so can position themselves advantageously, extract significant revenue and build significant power. As such, the relations constituted by and through supply chains are significant sites for governance in contemporary societies, as I now explore.

8.3.1 Operation and Control of Technology

Distribution of modularised computing resources through services and their integration into applications involves legal, technical and economic relationships through which control over various aspects of technologies is assigned between multiple actors. In integrating services into applications, developers delegate control over certain aspects of their application to providers. The corollary is that providers delegate limited and conditional control of certain aspects of their systems to customers or end-users,Footnote ⁴¹ while retaining control of other aspects of that technology (delegated to them from the customer’s perspective). This would be impossible without data’s flow linking geographically dislocated actors and enabling control to be split between and exercised separately by them.

A key feature of data-driven supply chains is therefore that different people simultaneously operate or control various aspects of the same systems, allowing them to provide some service, undertake some computation, supply some functionality or produce some application. This is enabled by modularisation of computing resources and underpins their distribution through APIs. ‘Operate’ here means running computing infrastructures an actor owns, under their retained control or another party’s delegated control. ‘Control’ means deciding questions around systems’ design and development, who they are used by, in what way, for what purposes and so on. Some such questions relate to a technology’s essential aspects, going to the system’s core function.Footnote ⁴² These are generally uniform across instances, as variation would affect the service’s core features, with providers retaining control for technical and commercial reasons. Other aspects are incidental,Footnote ⁴³ not relating to core functions and could vary between instances (particularly as supply chains unfold dynamically across various patterns). These may be delegated or retained.

There is therefore an exchange of control of certain aspects of technologies between actors and a potentially complex distribution of responsibilityFootnote ⁴⁴ for them (in that multiple actors are factually responsible in different ways for different practical aspects of their production, deployment and use). Application vendors may sub-delegate some of the control delegated to them by providers while retaining aspects of that control themselves (the degree of delegated control often diminishing with each step in a chain). For example, the food delivery app vendor may allow restaurants to personalise menus to end-users with a recommender service from the vendor’s cloud provider, thereby sub-delegating some control over that underlying technology to restaurants. Yet they may retain some (delegated) control over other aspects of the recommender service, allowing it to be integrated with other platform features (particularly if those aspects of the recommender service go to the platform’s core intermediary function and are therefore essential). Operators may have their own providers, contributing to development or operation of their technologies, with exchanges of control up and down the chain.

Exchanges of control necessarily vary: different things are essential – and control over them typically retained – to different services and applications. Providers may also retain control over incidental aspects relating to data production and policy enforcement (for example) to minimise their potential legal and commercial risks and maximise their benefit from the platform. Moreover, different kinds of service or application – with different core functions – necessitate different retention and delegation. In Software as a Service (for example), where customers access whole user-facing applications remotely, delegated control is more limited. In Infrastructure as a Service, however, where customers can install and run software they choose on lower-level computing resources, delegated control is necessarily greater and retained control correspondingly less. In AI services, providers retain significant control over producing and operating their system while delegating much of its deployment and use to customers.Footnote ⁴⁵

Digital technologies thus often involve complex patterns of operation and (sub-)delegation of control which produce supply chains. For example, the storage provider Dropbox used AWS’s infrastructural services to host customer data.Footnote ⁴⁶ Dropbox necessarily delegated control over some incidental aspects of their application to AWS, who operated the underlying technology. AWS delegated to Dropbox control of other aspects of that technology (incidental to an infrastructure service): what kind of information is stored, on whose behalf, and when and how it is retrieved. Dropbox, in turn, sub-delegated some control to their customers (such as the specific information stored). However, other aspects of the control AWS delegated to Dropbox form essential aspects of a storage service, going to its core function, and Dropbox therefore retained them (such as around which customer’s data is stored, with what access controls, and mechanisms for storage and retrieval). Through this, both AWS and Dropbox retained control over different aspects of the same technologies which were essential to their respective services, while delegating control over other aspects of those and other technologies to each other and to the end-users.

8.3.2 Exchange of Control and Interdependence

Interdependence is thus a key dynamic in data-driven supply chains. Through retention and (sub-)delegation of control, each actor does something which triggers, enables, or underpins others’ activities. As such, each actor depends on othersFootnote ⁴⁷ in ways which reflect and shape patterns of operation and control: giving inputs, undertaking computation, applying outputs, providing services which support and enable their activities, and much more.

With the hypothetical food delivery app, for example, each actor does things which others depend on – through the supply chain – enabled by data flows between them. Cloud providers operate technical infrastructure underpinning the platform, controlling retained aspects of their service but otherwise acting under control delegated to the vendor, who pays service fees. The vendor controls essential aspects of their platform to intermediate between restaurants, customers and riders (such as for assigning deliveries to riders), as well as over incidental aspects which shape their relations, while customers and restaurants pay fees. Riders control some aspects of the platform relating to them – accepting or declining jobs and so on – and deliver food from restaurants to customers, in return for fees from vendors. Other supporting providers contribute to various aspects of the platform (around payments, security, content delivery and others). This involves a constellation of actors, where data’s production in client devices, processing in servers and flow through supply chain components underpins exchanges of control which link them dynamically into a fluctuating web of interdependent relations and enables their various activities and interactions.

Yet providers’ role in supply chains – and therefore their business model and market position – depends on others as much as anyone else’s. Discussions around digital technologies sometimes overlook this fundamental interdependence, framing people, organisations or societies as dependent on providers. Yet without others doing things which use their services, providers would play no role in a supply chain; indeed, without others’ activities, there would be no supply chain to be part of at all. Moreover, supply chains’ dual purposes – also producing data for development processesFootnote ⁴⁸ or advertising-based revenue streamsFootnote ⁴⁹ – means production and ongoing development of the technologies through which providers partake in chains depends in part on others in them, as does their income. Choices which enable providers’ activities are of course conditioned both by their capture of markets and by dynamics which tend towards supply chain consolidation around certain players (and which providers proactively pursue). But the fact remains that providers’ position is constituted by and sustains only through mutually dependent relations.

8.3.3 Structuring Patterns of Interdependence

Supply chain interdependencies are, however, asymmetric in ways which reflect asymmetries in patterns of operation and control. Patterns of operation are often asymmetric both within and across chains, shaped by differences in technical and financial resourcing and by commercial, legal, and political economic influences. Services and applications rely on data production and processing, for example, yet operating computing infrastructures to produce and productively use data may require significant financial and technical resources – consequently, global markets for infrastructural computing services are particularly (and increasingly) concentrated around three companies.Footnote ⁵⁰ Law is important in constituting both capitalismFootnote ⁵¹ (generally) and informational capitalismFootnote ⁵² (specifically) – enabling platformisation,Footnote ⁵³ supporting surveillance business modelsFootnote ⁵⁴ and shaping technological development.Footnote ⁵⁵ Intellectual property laws protect closed-source, proprietary systems.Footnote ⁵⁶ Intermediary liability protections reduce legal risks of operating services at scaleFootnote ⁵⁷ (which might otherwise be insurmountable) by limiting claims for customers’ or users’ activities.

Providers may adopt strategies to reinforce and amplify asymmetries in operation – hoarding patents and other intellectual property; lobbying to create or exacerbate regulatory barriers to entry; or (relatedly) lobbying around licensing, labour or data protection law (for example). Providers typically pursue vertical and horizontal integration, seeking to maximise economies of scale and reduce the extent to which their own platforms and services rely on infrastructure operated by others (some providers, such as Google, Amazon and Microsoft, have achieved high levels of integration). Moreover, providers may incentivise customers to use several of their services rather than those of competitors, centralising applications around their technologies and amplifying asymmetries in operationFootnote ⁵⁸ (as a provider can operate not just some technologies underlying an application, but potentially many).

Patterns of control are typically asymmetric in ways shaped by patterns of operation. Indeed, providers can leverage asymmetries in operation towards asymmetric patterns of control: more vertically integrated providers – operating much of the infrastructure for their services – can delegate to fewer of their own providers (for example). Yet patterns of operation do not determine exchanges of control. Rather, control within and across chains is also shaped by legal and political economic context, by technical necessity (delegating control to individual customers of aspects of services which are uniform across instances would not necessarily work), and by providers’ commercial interests in retaining control over both essential and incidental aspects. Indeed, providers may delegate the minimum control needed to allow customers to use their service, retaining as much as possible for themselves. While legal, technical, economic relationships between actors in captured markets are configured in many ways around providers’ interests, patterns of control thus arise from interactions of all sorts of influences, shaping relations and exchanges between providers, vendors, suppliers, customers and others.

Law, for instance, structures patterns of control in a general sense, shaping and underpinning the relations through which providers’ market position arises. For example, delivery riders’ legal classification as workers, employees or self-employed affects their individual and collective protections and rights against the vendor and the degree of control they may have over certain aspects of the platformFootnote ⁵⁹ (and may prompt reform to address social and legal implications of new ways of working).Footnote ⁶⁰ Restrictions on industrial action and collective bargaining affect riders’ abilities to act together to protect their rights and interests by limiting the vendor’s control over aspects of the platform which shape their work and interactions with customers and restaurants.Footnote ⁶¹ Data protection and privacy laws shape the processes of capture and of data’s production, processing and flow (with the commodification and economic value of data – a key reason why differential abilities to produce and productively use data matter in structuring supply chains – itself being legally constructed).Footnote ⁶² These data protection and privacy laws typically rely on the principle of individual control by data subjects,Footnote ⁶³ limiting opportunities to challenge systemic problems or represent collective interests.Footnote ⁶⁴ Regulatory compliance obligations may present barriers to new market entrants, and lax competition enforcement combined with providers’ financial resources often allows them to buy out potential competitors.

Law thus affords conditions for patterns of operation and control and shapes interdependencies across societies. Asymmetries in these produce asymmetries in supply chain interdependencies, which are often heavily unequal both within and across chains. Within chains, individual customers (or users) generally depend much more on a provider’s services – potentially underpinning essential aspects of the application’s core function – than the provider depends on their custom. Across chains, due to market concentration, many customers may depend a great deal on a single provider, who seemingly barely depends on the others individually.Footnote ⁶⁵ Individual delivery riders may depend on the food app vendor for much of their income, whereas each rider plays a relatively minor role in the vendor’s service (which may have many potential riders). Yet often-overlooked collective dimensions matter: if riders unionise or otherwise act collectively, the vendor’s dependence on riders as a whole, rather than individually, quickly becomes apparent.

8.3.4 Regulatory Power

Asymmetries in supply chain interdependencies arising from asymmetric patterns of operation and control produce, shape and intensify power dynamics within and across chains which are also asymmetric (often greatly). These asymmetries potentially allow providers to make access to technologies which are essential to applications in many markets and sectors conditional on acceptance of certain requirements.Footnote ⁶⁶ Indeed, Cohen argues that platforms’ legal and technical protocols perform a ‘double function’: ‘affording access but also points of contact for exercises of technological and political authority’.Footnote ⁶⁷ Through these points of contact, providers aim to extend their power up and down chains in attempts to maintain their position, minimise legal and other risks and responsibilities and maximise their commercial benefit.

For example, the vendor’s control of aspects of the food delivery platform which are essential to its core function of intermediating between restaurants, customers and riders – itself conditioned by law and by the vendor’s relationships with providers who operate or control underlying technologies – produces key asymmetries in their collective interdependence which favour the vendor. This allows the vendor to insist on retaining incidental aspects of the platform which amplify asymmetries in interdependence with and between platform users and perform some governance function – algorithmically shaping interactions between restaurants, customers and riders, producing and extracting data for targeting and enforcing policies – thereby permitting them to structure those relations to maximise their commercial benefit from the platform’s core function of intermediation. A cloud provider may insist on retaining control over incidental aspects of services to restrict purposes or contexts of use to reduce legal or reputational risk, or which limit integration with competitors’ services.

Sizeable asymmetries in interdependence afford certain providers regulatory power in their relations with others:Footnote ⁶⁸ the capacity to durably affect or constrain their behaviour. This regulatory power is not held by one actor exclusively, but is multipolar: cloud providers may have some regulatory power in their relations with the food app vendor, for example, while the vendor has some regulatory power in their relations with restaurants and riders (itself conditioned by the cloud provider’s regulatory power in their relations with the vendor). Yet the power dynamics between the app vendor and a delivery rider, for example, result also from the relations between riders themselves and whether they act individually or collectively. Power dynamics in data-driven supply chains therefore arise relationally but multilaterally through the interactions of the many actors therein (conditioned by the legal, social, technological and market factors which shape those relations). Providers may exploit their regulatory power in efforts to build, maintain, and amplify further legal and technological asymmetries both within and across chains, shaping the activities of individual customers and users and power dynamics in captured markets to their advantage. Although regulatory power is multipolar, asymmetries in supply chains thus produce asymmetries in that power which offer opportunities for extensive private ordering by providers.

The services model – affording the ability to dictate terms and alter, withdraw or cancel services at will – itself offers providers opportunities to retain some control over deployment of their technologies in customers’ applications in ways which would have been impossible with traditional software licensing via physical media.Footnote ⁶⁹ A primary mechanism for this is standard form, take-it-or-leave-it contractual Terms of Service.Footnote ⁷⁰ These establish legal relationships which underpin technical and economic relationships and through which customers and users exchange control in particular ways (in the context of commercial, technical, legal and other influences setting a general structure to them). At the same time, however, providers also impose terms for exchange of control which seek to minimise legal costs, risks, responsibilities and accountabilities by passing them to others.Footnote ⁷¹ As such, they are influenced by (for instance) intermediary liability, intellectual property, data protection and employment laws, but they also make normative claims about those laws’ meanings in the context of their relations with customers and users and – as a result – shape their effects to providers’ advantage.

Employment status for delivery riders (for example) depends on broader legal context, but the food app vendor can construct their Terms of Service (and their practices and the platform’s operation) towards one classification or another. In other cases, providers’ Terms may make intellectual property law claims to restrict access to their proprietary technologies and foreclose efforts to better understand how those technologies work, while claiming rights to use others’ intellectual property to train models and improve services.Footnote ⁷² Providers may similarly seek to legitimate their practices in data protection law, claiming questionable legal bases for data processing and rights to use data for development, service improvement, and tracking and targetingFootnote ⁷³ (obtaining data being an important aspect of platforms’ competitive strategiesFootnote ⁷⁴ and producing data being a key function of supply chains). Providers may claim to be processors in data protection law,Footnote ⁷⁵ seeking to place primary compliance and regulatory responsibilities for their data practices onto customers (aided by data protection law’s binary distinction between controllers and processors).Footnote ⁷⁶ Terms may also disclaim liability for things not covered by intermediary liability protections, even where problems originate in technologies providers operate or where they retain control.Footnote ⁷⁷ Moreover, Terms may contain choice of law or arbitration clauses to resolve disputes over meaning in favourable jurisdictions or away from formal legal processes.

In effect, through their Terms of Service, providers use various areas of law as both swords and shields in the relations through which their position and power arises, structuring their legal relationships with – and the activities of – other supply chain actors. Providers seek maximum retained control over their technologies (depending on the type of service) as far down chains as possible – and maximum benefit from that control – while externalising costs or responsibilities which might otherwise come with it (often attaching in these agreements to the more limited control delegated to others). Through this, enabled by simultaneous control by separate actors of different aspects of the same systems, legal rights and benefits around operation and control (on the one hand) are decoupled from legal risks, responsibilities and obligations (on the other) and arranged in ways which maintain and amplify technological and legal asymmetries to providers’ benefit.

The regulatory effects of softwareFootnote ⁷⁸ are also leveraged by providers in the design of platforms and services to prevent or affordFootnote ⁷⁹ different activities by users in line with platform policies. In other cases, providers may retain control over incidental aspects of technologies allowing them to enforce policies and restrictions to limit customers’ delegated control through APIs, the design of services, or other means. The recommender service provider which underpins personalisation in the food delivery app (for example) may delegate control over the system such that the vendor can integrate it into the platform, while (for policy purposes) retaining control allowing them to limit the kinds of content restaurants input for that personalisation. A content delivery network provider may delegate control to allow customers to use that service to underpin applications of many kinds, while also retaining rights to refuse content they find objectionable or commercially difficult. If the content network provider is several steps up or down a chain from the point where content is ‘submitted’, those rights will necessarily be extended through those steps (i.e. the provider extends retained control up the chain to govern the activities of actors they do not have a direct relationship with). A facial recognition service provider may use automated checks to restrict why and where customers can deploy that service. Such mechanisms may extend an application’s supply chain – the recommender service provider may use another provider’s content moderation service to check inputs for compliance, for instance (involving another exchange of control between the recommender service provider and the moderation service provider).

Asymmetries in supply chain interdependencies thus provide conditions by which certain actors shape others’ activities to their benefit. Through these strategies, providers’ regulatory power affects what customers can do for their customers and end-users in turn and therefore exchanges of control within and across chains more generally. Asymmetric patterns of ownership and control, constructed by and combined with asymmetries in legal rights and obligations, thus contribute to structuring supply chains in ways that allow providers to reinforce and amplify those asymmetries and further consolidate capture of markets and social relations. These dynamics unfold in contexts where various influences shape and amplify asymmetries in interdependence and balances of power dynamically in ways which were not inevitable and are not unchangeable. Providers’ position and regulatory power in data-driven supply chains is therefore not a technological phenomenon, but a socio-legal one which can – in principle – be conditioned, contested, and dismantled.

8.4.1 Asymmetries in Operation and Control

Asymmetric interdependencies – reflecting asymmetries in operation and control – provide underlying conditions for providers’ regulatory power in supply chains; they should therefore be core considerations for governance of supply chains. Providers’ control over essential aspects affords asymmetric interdependencies, allowing providers to insist on retaining control over incidental aspects, shape others’ activities to their benefit, and impose conditions of access which reinforce and amplify asymmetries. As such, a key regulatory goal should be arranging patterns of control to address asymmetries in interdependence: which aspects of what kinds of service are retained by and delegated to whom; who controls essential aspects relating to core functions and who controls others. Where platforms algorithmically intermediate markets, for instance, providers typically retain significant control for technical and commercial reasons. This might instead be distributed as appropriate between the actors who actually constitute those markets to mitigate or eliminate the provider’s regulatory power and balance interdependencies between them. Where conflicts between different interests arise – for example, where incidental aspects of a platform affect both riders and restaurants and could therefore be controlled by either – control should be assigned according to the goal of balancing interdependencies. What is appropriate differs between markets and sectors, and between services with different core functions, so (re-)distributing control requires a specific understanding of services and of the social and economic relations around them.

Importantly, individualised control has limitations, not least because of any remaining asymmetries between providers and individual customers or end-users. Moreover, features of services which are uniform across instances – such as essential aspects of systems going to their core function – may not be individually variable for technical reasons. Legal and regulatory governance mechanisms may therefore seek collective control of some or all such aspects. For the food delivery app, for example, this could be mutualised, cooperative, or other collective control over certain essential aspects of the platform’s intermediation function by particular groups with concentrated interestsFootnote ⁹⁸ – such as delivery riders – or of incidental aspects which perform some governance function. Collective control over essential aspects could rebalance core interdependencies, which between providers and customers as a whole are perhaps not so asymmetric. This can be combined with other strategies aimed at incidental aspects of services: for instance, delivery riders as a whole might collectively control the food app’s essential aspects even while particular riders and restaurants have more individualised control over incidental aspects relating to their activities through the platform. More generally, legal restrictions which prevent certain actors from acting collectively,Footnote ⁹⁹ or frameworks such as data protection which focus on individual control and limit opportunities for collective intervention or redress,Footnote ¹⁰⁰ should be revisited with a view to balancing interdependencies in this way.

Collective control over essential aspects of infrastructural services is difficult given the diverse and diffuseFootnote ¹⁰¹ interests of customers across markets and sectors accessing the same general-purpose technologies. Moreover, there may be multiple ‘steps’ up and down chains from the point of infrastructural services, which makes distributing control to customers, end-users, or others difficult. However, addressing asymmetries in interdependence fundamentally involves reducing the relative importance of any single actor’s retained control. As such, meaningful representation or protection for groups of shared interest – such as data subjects’ shared interest in the protection of their personal data,Footnote ¹⁰² or content creator’s shared interest in protecting their intellectual property from appropriation into AI production – to collectively control or contest retained aspects of providers’ services may help. Law may also seek to restrict infrastructural providers’ ability to leverage control of essential aspects of services into retaining control of incidental aspects which amplify asymmetries in interdependence and afford regulatory power. This could involve reducing providers’ discretion in insisting on particular exchanges of control with customers, by identifying the essential aspects of different kinds of service (based in the core function they perform), regulating the conditions for providers’ retention of those aspects, and passing control over others to customers where possible. Again, this requires specific understandings of particular kinds of service, which will fulfil different core functions.

Mitigating asymmetries in operation (or their effects) at infrastructural level may be possible through interventions to reduce the relative importance of operating particular technologies and create space for alternatives, such as requiring open sourcing of proprietary systemsFootnote ¹⁰³ or interoperabilityFootnote ¹⁰⁴ between platforms.Footnote ¹⁰⁵ Enforced separations between infrastructural and user-facing services (challenging vertical integration), or requiring providers to divest certain services, limit reuse of data in development across services,Footnote ¹⁰⁶ or limit reuse of models or systems across services (challenging horizontal integration) may also help. Some of these interventions have been proposed or sought in certain jurisdictions.

8.4.2 Asymmetries in Legal Rights and Obligations

Asymmetric patterns of operation and control do not fully explain governance in supply chains, however. Various other influences and supply chain dynamics shape and amplify asymmetries in interdependence, including laws which afford providers’ position in patterns of control. Moreover, providers’ regulatory power works in part through certain legal arrangements with others – their Terms of Service strategically interpret and make normative claims about relevant laws and legal frameworks to their advantage. Addressing regulatory power therefore requires addressing asymmetries in legal rights and obligations which influence supply chain interdependencies and exchanges of control in complex ways, reinforcing and amplifying technological and other asymmetries.

As described above, providers’ Terms work with various frameworks to decouple legal rights and benefits around operation and control of technologies from legal risks and responsibilities, arranging them to instead maximise providers’ commercial benefit and externalise liabilities and accountabilities to the limited control delegated to customers. A key goal for legal and regulatory frameworks in structuring interdependencies between actors is therefore to reliably align legal risk and responsibility with operation and controlFootnote ¹⁰⁷ – particularly for infrastructural services where re-distributing control is difficult. This means assigning roles, responsibilities, rights, obligations and accountabilities to reflect factual distributions of control over both essential and incidental aspects of technologies in accurate, sufficiently nuanced, and clearly specified waysFootnote ¹⁰⁸ – to ensure that providers who benefit from services used across societies and economies bear the appropriate costs, that legal responsibilities around production and operation go to those who are factually responsible for them, and that customers’ and end-users’ rights and interests further down chains are properly protected. Addressing providers’ ability to unilaterally determine Terms of Service violations at their discretion, remove customers’ access at will, and limit avenues for challenge or redress may also help reduce the relative importance of providers’ retained control.