How GDPR could weaken, not strengthen, the duopoly