Too much information, too little competition: on the interplay of competition and privacy

Aline Blankertz // More and more investigations by competition and data protection authorities deal not only with one of privacy and competition, but both at a time. Experts argue that “the misuse of consumer data and harm to privacy is arguably an indicator of low quality caused by a lack of competition,”¹ and “market power affects both the choices that data subjects realistically have and the privacy risks they are exposed to.”² There are various ways in which competition affects privacy.³

Two of the most prominent cases illustrate the complexity which links privacy and competition. Firstly, the Bundeskartellamt, the German national competition authority, has brought the pioneering Facebook case in which the authority seeks to establish that imposing privacy terms can amount to an abuse of dominance.⁴ Secondly, Apple and Google are facing claims that they are using privacy as an excuse to hamper competition because they limit access to personal data by third parties while boosting their own presence on advertising markets. We will look at them in turn.

When dominance hampers choice: the Facebook case

After a three-year investigation, the Bundeskartellamt announced in early 2019 that Facebook had violated the General Data Protection Regulation (GDPR) and therefore, abused the platform’s dominance. Facebook was found to be a dominant social network that exploited its users by imposing unfair terms that users could not reject if they wanted to use the platform. These unfair terms enabled Facebook to collect data on its users from multiple sources beyond its platform, including even third-party websites that incorporated “Like” or “Share” buttons or used Facebook’s analytics services. The Bundeskartellamt imposed on Facebook an obligation to obtain voluntary consent from users to merge data from various sources, effectively requiring “internal unbundling” of data.

Since then, courts have not yet managed to reach any clear conclusions. Different courts have argued in favour of different readings of the case and different theories of harm:

• Bundeskartellamt decision (2019):

  • Infringement of GDPR constitutes abuse of dominance

  • Involuntary nature of consent renders consent invalid

• Higher Regional Court Düsseldorf suspension (2019):

  • Bundeskartellamt did not demonstrate causal link between dominance and outcome

• German Federal Court of Justice reinstatement (2020):

  • Potential exclusionary abuse on advertising markets

  • Lack of choice leads to stronger privacy intrusion

• Higher Regional Court Düsseldorf (2021): referral to the European Court of Justice

• European Court of Justice (2022?):

  • to clarify various questions relating to the GDPR and, most importantly, if cartel authorities can assess GDPR infringements.

While the legal assessment is still up in the air, it is self-evident that the options of a consumer are different when they deal with a firm that has only a few and/or weak competitors: They have less choice. Choice is a shared objective of privacy policy and competition policy and indicates functioning competition, as markets generating a broad range of offers serve various needs and preferences. Choice also matters for understanding informational self-determination. Where a market offers no choice regarding privacy, for example, because of firm concentration, consumers cannot influence to what extent they are exposed to tracking unless they abandon that market entirely.

The challenge is to clearly conceptualise choice such that it is clear when the lack of choice amounts to anticompetitive harm. Specifically, in the Facebook case, the Bundeskartellamt and the Federal Court of Justice find that the lack of choice when faced with a dominant player puts informational self-determination at risk and constitutes exploitative abuse of users. This means that a lack of alternative options can make a firm’s behavior problematic just because the firm is dominant, even if its behavior does not systematically differ from that of smaller firms.

When ecosystems set privacy rules for everyone: the ad changes by Apple and Google

Both Google and Apple have recently made changes to their advertising networks to limit tracking by third parties. Google is rolling out the so-called Federated Learning of Cohorts (FLoC), a technology that, by processing data on-device, groups individuals into cohorts to which advertisers target content. Apple requires apps to obtain granular consent in their App Tracking Transparency (ATT) framework before apps can track users across apps or websites; this change coincided with the announcement of Apple’s expansion of on-device ad targeting capabilities.

When firms that operate ecosystems (often referred to as gatekeepers, such as in the EU draft Digital Markets Act) decide whether to share personal data and/or enable its collection, privacy may be enhanced, but competition may suffer as a result. The concern is most evident if the operator competes with other firms within its ecosystems and gives itself preferential access to data. Smaller firms may find themselves shut out because they are unable to compete with the dominant firms in related markets that draw on personal data as an input.

The French competition authority Autorité de la concurrence has already reached some conclusions in relation to advertising data. It rejected an application for interim measures by players of the online advertising sector that had sought to prevent Apple from implementing the ATT framework. The Autorité found that, in principle, the operator can impose restrictions and that consumers have generally expressed support for the policy change; however, it continues to investigate the merits of the case.⁵ At the same time, the Autorité has required Google to modify its treatment of competing ad service providers because it was sharing more data within its own network than with external providers.⁶ While this case does not directly relate to personal data, it shows that data sharing within an ecosystem can have anti-competitive effects, and the line between privacy or other reasons for limiting external data sharing is not always clear.

The outlook: more integration on the horizon

Across Europe, competition and data protection authorities are starting to collaborate more, finally giving heed to calls for more integration of competition law and privacy law as well as enforcement.⁷ The ECJ will provide more clarity on the role of competition authorities in assessing GDPR infringements; the draft Digital Markets Act contains some provisions that reinforce GDPR principles, but with an underlying competition consideration. More authorities will continue to investigate the changes to the advertising sector to understand their implications for privacy and for competition. In some cases, such as in the Facebook cases, it may be possible to promote both competition and privacy by giving more choice to consumers. In other cases, such as in advertising, it may be inevitable to address trade-offs between privacy and competition. To reach a consistent framework for assessing such trade-offs, even more interaction between data protection and competition experts is necessary, both at the research and the enforcement stages.

Aline Blankertz, Data Economist + Platform Economy/Digtal Policy/Competition/stiftung neue verantwortung (Berlin)/University of St. Gallen