The Court of Justice of the European Union (CJEU) has ruled in favour of Germany’s antitrust watchdog in a court battle against Facebook and Instagram owner Meta, in a decision which will limit Meta’s ability to share data between its various platforms for use in targeted advertising in Germany. The CJEU’s decision is significant not only for the blow it deals to Meta’s ad business in Germany, but also for the legal precedent it sets in Europe: that antitrust regulators can rule on data privacy matters so long as there is sufficient connection between the two.
The court case relates to a ruling made by Germany’s Federal Cartel Office (FCO), or Budeskartellamt, back in 2019. The FCO ordered Meta (still just known as Facebook at the time) to stop linking user data between its various services – namely Facebook, Instagram, and WhatsApp – as well as with third-party data sources.
This ruling came less than a year after the EU’s General Data Protection Regulation (GDPR) came into force, at a time when numerous court cases and reviews of big tech companies’ data collection practices were being launched. But what was unusual about the FCO’s ruling what how it linked data privacy (which isn’t the FCO’s domain) with competition (which is).
Facebook asks for consent to share data within its services, and link in data from third-party sources, within its terms and conditions. But users have to agree in order to be able to use Meta’s products. And the FCO sees this as an abuse of Meta’s dominant position in the social media market – users either have to agree to Meta’s conditions, or find themselves locked out of the most popular social and messaging apps.
Thus, the FCO ruled that Meta must ask for explicit consent to share data, and must not prevent people from using its apps if they don’t agree to those conditions.
Meta contested this ruling, arguing that the FCO had overstepped its bounds as a competition regulator. And it was this contention which saw the case escalated to Europe’s highest court.
Social pressure
In the short term, this will mean that Meta will have to comply with the FCO’s ruling in Germany, limiting its ability to share data for advertising purposes without explicit user consent.
But it also opens the door for other competition regulators in Europe to make rulings relating to the GDPR. The CJEU says that national competition authorities shouldn’t replace data regulators where they identify infringements of the GDPR. And where appropriate, they should consult with their local data regulators on any possible infringements. But the CJEU says competition regulators may investigate potential infringements of the GDPR if those infringements are framed as an abuse of a dominant position.
And the court explicitly validated the idea that a tech platform’s dominant position in its market can affect the legitimacy of consumers’ consent to processing of personal data. “The Court notes that the fact that the operator of an online social network, as controller, holds a dominant position on the social network market does not, as such, prevent its users from validly giving their consent, within the meaning of the GDPR, to the processing of their personal data by that operator,” said the Court in a statement. “However, since that position is liable to affect the freedom of choice of those users and create a clear imbalance between them and the data controller, it constitutes an important factor in determining whether the consent was in fact validly and, in particular, freely given.”
Meta is of course not the only major platform which arguably strongarms users into handing over data through its dominant marketing position – opening the door to further rulings along similar lines in the future.
