A lack of informed user consent for how Facebook collects and combines data from its social network, its messaging apps, and third-party sites that are linked to these apps, coupled with concerns over whether Facebook is monopolizing social media in Germany, lie at the heart of a recent decision against Facebook by the country's competition regulator, the Bundeskartellamt. The regulator states that Facebook's dominant market position in Germany means that its users must either "accept the comprehensive combination of data or to refrain from using the social network" – neither of which are a palatable choice for most users. The Bundeskartellamt has asked Facebook to get voluntary user consent to collect and combine non-Facebook data, and has said that it is not enough for Facebook to ask for consent as part of its terms and conditions. Also, users must be allowed to continue using Facebook services even after they have opted out of data collection and processing.
For its part, Facebook says it disagrees with the Bundeskartellamt's conclusions regarding its market position in Germany, stating that "popularity is not dominance," and that it faces "fierce competition" in Germany from companies such as Twitter, LinkedIn, YouTube, and Snapchat. However, each of these four apps differ from Facebook in significant ways, and none has anywhere near the market reach.
Facebook adds that the regulator misinterprets its compliance with Europe's General Data Protection Regulation (GDPR) – a central premise of which is that organizations must obtain consent from their customers or users to store and use their personal data. The social network also takes issue with the fact that the Bundeskartellamt regulates competition and not data protection, meaning that strictly speaking, it is not in a position to interpret GDPR compliance. However, the Bundeskartellamt's decision is made on the basis that Facebook is using the data it collects to harm competition, not data privacy. Further, Facebook posits that the decision, if enforced, would actually undermine Europe's data protection laws – likely because it means there would be inconsistency between Germany and other European markets in how GDPR is implemented. Facebook intends to appeal the decision.
Whatever the outcome in Germany, it seems more and more likely that Facebook can no longer avoid more stringent regulation, despite the efforts it has recently made to address data privacy on its platforms, including enabling new privacy tools for users and its forthcoming Clear History feature. Clear History will allow users to disassociate from their accounts some of the types of data about which the Bundeskartellamt is concerned, i.e. the information that Facebook receives from the third-party websites that use its tools.
The German regulators have form in reining in Facebook: in April 2017, Facebook was forced to stop data sharing between WhatsApp and Facebook across Europe, following intervention by Germany's data protection authority, on much the same basis as the Bundeskartellamt's decision – Facebook had not gained user consent. If Facebook is not able to address the Bundeskartellamt's concerns, its proposed integration of the messaging capabilities of Facebook Messenger, WhatsApp, and Instagram seems uncertain – at least in Germany (and potentially throughout Europe) – given that carrying out the integration will require data sharing between the three apps.
Figure 1: Facebook and the top four messaging apps, monthly active users, 2014–19
The fact is that Facebook owns the biggest social network in the world, and it also owns three of the world's four largest messaging apps, with a combined user base of 2.7 billion monthly active users (MAUs) (see Figure 1), which means that it does have significant market power not only globally, but also in most countries, and will therefore continue to attract the scrutiny of regulators. And that scrutiny will only increase as Facebook makes its play for what is shaping up to be a second monopoly, in communications apps.
Data collection and processing are not the only areas in which Facebook will be studied. Lawmakers in Germany and beyond will also be looking at the implications of Facebook's proposed implementation of end-to-end encrypted messaging across these apps. Australia has already enacted legislation, the Assistance and Access Bill 2018, that compels the communications industry to assist security and law enforcement agencies in monitoring encrypted communications services. Facebook will not want to give Germany any encouragement in following suit.
Straight Talk is a weekly briefing from the desk of the Chief Research Officer. To receive this newsletter by email, please contact us.