The EU General Data Protection Regulation (2016/679, GDPR) was enacted to regulate digital platforms who process excessive amounts of personal data and dominate today's online markets. However, the has not fully succeeded in meeting this goal. This article argues that effective regulation should be based on understanding power these companies hold. power, stemming from control over data, weaken...