When competition law met data protection: the Bundeskartellamt’s Facebook decision

When competition law met data protection: the Bundeskartellamt’s Facebook decision - kon karampelas HUBofEFQ6CA unsplash scaled

On February 6th, the German Competition Authority (Bundeskartellamt or BKA) adopted its long-awaited Facebook decision, imposing far-reaching restrictions on how the social network can collect and process user data. This decision follows a preliminary assessment that the BKA published in December 2017, which this blog discussed at length.

The BKA’s decision—as set out in a case summary and background paper—sticks closely to its preliminary assessment. In this blog post, I therefore recap what the case was exactly about, discuss what the current decision means, and look forward to what’s on the horizon for Facebook.

The issue: Facebook’s data processing

The BKA started a case against Facebook based on the way the social network collects and processes user data. The authority has not been concerned with the treatment of data generated by the use of the social network itself (termed ‘on Facebook’). After all, ‘the provision of a social network aiming at offering an efficient, data-based business model funded by advertising requires the processing of personal data. This is what the user expects.’

What the authority takes issue with is how Facebook collects and processes data from third-party apps and websites (‘off Facebook’). Firstly, Facebook collects data from its daughter apps WhatsApp and Instagram. Remember that in the course of merger proceedings, Facebook once declared it would be technically infeasible to match users’ Facebook and WhatsApp accounts in order to better target ads on Facebook. When that appeared easier than expected, the Commission fined Facebook €110M for providing misleading information.

Secondly, Facebook collects data from any website that uses ‘Facebook Business Tools’, which is any website where you can ‘like’ or ‘share’ content, where you can log in through your Facebook account, or that uses Facebook’s analytics services. When users spend time on such websites, this data is also added to their Facebook profile, leading—again—to more targeted advertisements.

When it comes to these ways of collecting user data from outside the social network, the BKA holds that ‘the efficiencies in a business model based on personalised advertising do not outweigh the interests of the users’. Indeed, users are unaware of such data collection and have not consented to it.

The legal analysis: when competition law met data protection

As this concerns an abuse of dominance case, the BKA goes through the traditional steps of defining the relevant market, establishing Facebook’s dominant position on it, and laying out a theory of abuse.

Market definition

The BKA defines the relevant market as the social network market in Germany. In doing so, it explicitly recognizes Facebook as a multi-sided platform serving users on the one hand, and advertisers running targeted advertisements on the other. Of these two sides, however, the authority considers the user side a separate market, which is in line with scholarship on the issue. The fact that users make use of Facebook for free is not a problem, as the recently inserted §18(2a) of the German Competition Act makes it clear that ‘[t]he assumption of a market shall not be invalidated by the fact that a good or service is provided free of charge.’

According to the BKA, Facebook does not face a lot of competition in the social network market. Now that Google is shutting down its Google+ social network, all that’s left is a number of smaller German providers. Other online services commonly referred to as ‘social media’ are not included in the market, as they are not interchangeable enough from a consumer point of view. Professional networks such as LinkedIn, messaging services such as WhatsApp or Snapchat, or other social media such as Instagram, YouTube or Twitter are therefore excluded from the market.

Market power (dominant position)

When it comes to market power, the BKA focuses on the fact that ‘Facebook’s user-based market share is very high, especially among daily active users, where Facebook has a market share exceeding 95%.’ To be safe, the authority also notes that the services of the Facebook group ‘would have a combined market share far beyond the market dominance threshold’ even if one would include YouTube, Snapchat, Twitter, WhatsApp, and Instagram in the relevant market.

According to the BKA, this won’t change any time soon. While competitors are leaving the market, Facebook’s user figures keep rising (or at least stagnate at a high level). This ‘strongly indicate[s] a market tipping process which will result in Facebook.com becoming a monopolist.’ The main reason for such tipping is found in direct network effects, which imply that users benefit most from being active on the platform where most of the other users are active.

In addition, the BKA examines other factors affecting a multi-sided platform’s market power, including indirect network effects leading to barriers to entry, access to competitively relevant data, and innovation-driven competitive pressure (the relevance of all of these factors is explicitly recognized in the recently inserted §18(3a) of the German Competition Act). Taken together, the BKA concludes Facebook is in a dominant position.

Abuse of dominant position

When it comes to the actual abuse, the BKA holds that ‘[u]sing and actually implementing Facebook’s data policy, which allows Facebook to collect user and device-related data from sources outside of Facebook and to merge it with data collected on Facebook, constitutes an abuse of a dominant position on the social network market in the form of exploitative business terms’. In specifying the exact nature of the abusive behaviour, the BKA relies heavily on the General Data Protection Regulation (GDPR).

Firstly, the BKA takes great care to justify its reliance on the GDPR to establish a competition law infringement. After all, the European Commission’s position is that ‘any privacy-related concerns […] do not fall within the scope of the EU competition law rules but within the scope of the EU data protection rules.’

Instead of focusing on the Commission’s position, the Bundeskartellamt relies on the case law of the German Federal Court of Justice, which considers contract terms abusive if they violate the German Civil Code (in particular when such terms are imposed by a party with superior power). By analogy, the BKA holds that ‘the European data protection regulations […] can or, considering the case-law of the highest German court […], must be considered when assessing whether data processing terms are appropriate under competition law.’ As the GDPR does not aspire to full consistency of enforcement, competition authorities can also consider and interpret its provisions.

More specifically, then, Facebook’s terms and conditions violate the GDPR as there is no effective consent for such extensive processing of data pursuant to Article 6(1a). The problem lies in the voluntary nature of the consent, which cannot be assumed if such consent is a prerequisite for using Facebook in the first place. The problem, in other words, is that when users want to use Facebook, they don’t have a choice except than to accept all terms and conditions.

‘Ok, so there’s a violation of the GDPR—how is this a competition issue?’, one might wonder. The BKA argues that the infringement of data protection law is ‘a manifestation of Facebook’s market power’. There is a link of causality: because Facebook inappropriately processes user data, it has ‘gained a competitive edge over its competitors in an unlawful way and increased market entry barriers, which in turn secures Facebook’s market power towards end customers.’


The BKA orders Facebook to adapt its data policies. Facebook can no longer combine the data it collects from WhatsApp and Instagram with Facebook user accounts without obtaining voluntary consent. (When collecting data from third-party websites, such voluntary consent is already required.) According to the BKA, ‘voluntary’ means that ‘the use of Facebook’s services must not be subject to the users’ consent.’ Without such consent, it can only combine data from various sources to a highly restricted extent. Facebook was given twelve months to implement the necessary changes, but its appeal to the Düsseldorf Higher Regional Court may suspend this deadline.

Commentary: unnecessarily blurring the lines?

Of course, this decision has faced a lot of criticism. Facebook itself is evidently not amused; in a blog post, the company has set out how it believes the BKA ‘underestimates the fierce competition we face in Germany, misinterprets our compliance with GDPR and undermines the mechanisms European law provides for ensuring consistent data protection standards across the EU.’

It is fair to question whether the decision unnecessarily blurs the lines between competition and data protection law. The connection between the two, which the BKA finds in Facebook’s market power, is somewhat tenuous. Indeed, as Justus Haucap remarks, ‘there is little evidence that would suggest that larger firms violate data protection and privacy standards in a more systematic fashion than smaller firms – if at all, the contrary appears to be true.’

It is unclear whether there are other factors motivating the BKA. In the past, EU competition law has been used to compensate for sleepy regulators. Is a similar dynamic at play here? According to the GDPR’s enforcement mechanism, the Irish data protection supervisor is responsible for scrutinizing Facebook’s data policies. Such supervisors are far from toothless: they have the power to impose fines worth up to 4% of the total worldwide annual turnover of the infringer. Was the BKA unhappy with the lack of action on the part of the Irish data protection supervisor?

Looking ahead: more cases, and what about Facebook’s data integration ploy?

Two other questions remain. Firstly, will the BKA’s precedent be followed by other competition authorities? The Commission’s response, for one, was lukewarm. A spokesperson said it ‘took note’ of the decision and is ‘closely following’ the BKA’s work, adding that ‘[t]he European legislator has made sure that there is now a regulation in place that addresses this type of conduct’, namely the GDPR. Commissioner Vestager has also stated that she doesn’t believe the Facebook decision can serve as a template for EU action as it sits ‘in the zone between competition law and privacy’ and was based in part on German law.

Secondly, what does the BKA’s decision means for Facebook’s plans to integrate Facebook, WhatsApp and Instagram? According to a recently announced plan, the company will unify the underlying technical infrastructure of the various apps, which will make cross-platform communication possible. While the BKA’s decision is geographically limited to Germany, it at least presents an additional technical challenge for an already ambitious plan.



Friso Bostoen

Blog Editor

Assistant Professor of Competition Law and Digital Regulation, Tilburg University

Friso Bostoen is an assistant professor of competition law and digital regulation at Tilburg University. Previously, he was a Max Weber Fellow at the European University Institute. He holds degrees from KU Leuven (PhD, LLM) and Harvard University (LLM). Friso’s research focuses on antitrust enforcement in digital markets. His work has resulted in numerous international publications, presentations, and awards (including the AdC Competition Policy Award 2019 and the Concurrences PhD Award 2022). In addition, Friso edits the CoRe Blog and hosts the Monopoly Attack podcast.

>> Friso’s CoRe Blog posts >>

Hinterlasse eine Antwort

Zusammenhängende Posts

18. Mrz 2024
von Daniel Mandrescu
competition law, abuse of dominance, apple app store, the digital markets act

The Apple App Store – A New Kind of Hallmark Case

After almost three years since the Commission sent Apple its statement of objections, which was significantly trimmed down, the Commission reached a finding of abuse for which it imposed a whopping fine of 1.8 billion euros. Alongside this case, Apple was also involved in an almost identical case running parallel in the Netherlands, with similar findings. Meanwhile, during these procedures, […]
16. Nov 2023
Features von Daniel Mandrescu
platforms, dma, gatekeepers, digital markets act, apple, google, microsoft, smasung

Rebutting the gatekeeper status – what does it take?

The deadline for appeals on the gatekeeper designation under the DMA is nearing its end.  Since the DMA imposes gatekeepers with demanding obligations, it is only natural that the potential subjects of this regulation will attempt to contest this status. What remains, however, to be clarified is what prospective gatekeepers can put forward as evidence to avoid being designated as […]
07. Nov 2023
Features von Daniel Mandrescu
app store, apple, abuse of dominance, platforms, ACM, art. 102 TFEU.

The ACM vs. Apple AppStore – A Second Chance To Get It Right

The Dutch case concerning the Apple App Store appears to make a (welcome) comeback. The case that started in 2019 came to a rather disappointing end in the summer of 2022 when the Dutch competition authority issued a public statement that gave the impression that it was satisfied with Apple’s adjustments to the App Store front in the Netherlands. This […]
26. Okt 2023
von Daniel Mandrescu
airport travel

Booking / eTraveli: assessing envelopment strategies and mixing up market power thresholds

About a month ago the European Commission announced that it was prohibiting the acquisition of eTraveli by Booking Holdings (Booking.com). The prohibition, which is a rare occurrence in itself, did not attract much attention beyond comments on the ‘ecosystem’ theory of harm which it may have introduced. But this case offers more than that. First, it shows that current practice […]
12. Sep 2023
Features von Daniel Mandrescu
Microsoft teams antitrust claim, abuse of dominance, European commission

Microsoft III – Paving The Way To A Tying Trilogy?

This summer the European commission (finally) announced it will start a formal investigation against Microsoft following Slack’s complaint concerning the (abusive) tying or bundling or Teams to the Microsoft and Office 365 suites. Not long after, Microsoft came out with an official statement concerning the changes in its pricing and distribution strategy  of Teams it will introduce in order to […]
31. Aug 2023
von Parsa Tonkaboni
The ECJ Judgment in CK Telecoms – Setting the Record Straight? - 0122 Blog post

The ECJ Judgment in CK Telecoms – Setting the Record Straight?

Introduction On 13 July 2023, the European Court of Justice (‘ECJ’) delivered its highly anticipated ruling in CK Telecoms UK Investments v European Commission (‘CK Telecoms’). The Grand Chamber judgment is significant at the most fundamental level. It clarifies some of the core legal concepts and principles at the very heart of EU merger control. The five crucial issues the […]
18. Jan 2023
Features von Daniel Mandrescu
competition law, abuse of dominance, refusal to supply, Lithuanian railways, bronner, essential facility, art. 102 TFEU

Case C-42/21P Lithuanian Railways – another clarification on the Bronner case law and the non-exhaustive character of art. 102 TFEU

The recent case of Lithuanian Railways provides yet another clarification on the scope of application of the Bronner case law. The Judgement of the CJEU reconfirms exceptional character of the Bronner case law and the type of situations it is intended to apply to. By doing so the CJEU potentially helps prevent future disputes of a similar  nature in the […]
03. Jan 2023
Features von Daniel Mandrescu
facebook, competition law, abuse of dominance, art. 102 TFEU, multisided platforms, dominant position, tying and bundling, unfair trading conditions, competition economics, european commission,

On-platform Tying or Another Case of Leveraging- A Discussion on Facebook Marketplace

Just before 2022 ended the Commission sent a statement of objections to Meta regarding the potential abusive behaviour of Facebook. According to the statement of objections, Facebook may be engaging in (i) abusive tying practices with regard to Facebook Marketplace as users (i.e. consumers) that log into Facebook and are automatically also offered access to the Facebook Marketplace, without the […]
07. Dez 2022
Features von Daniel Mandrescu
market definition notice, relevant market, market power, market analysis, notice update, digital platforms, multisided markets, multisided platforms, online platforms, SSNIP test, SSNDQ test, Google android, Google shopping, merger control, abuse of dominance

The draft notice on market definition and multisided (digital) platforms – avoiding rather than resolving some of the main challenges

Approximately a month ago the Commission published its draft notice on the definition of the relevant market. The new notice is supposed to replace the old one that dates back to 1997 and thereby bring the entire process up to date with today’s new challenges, particularly in the context of digital markets. A first read of this long awaited document […]
15. Nov 2022
Features von Daniel Mandrescu
abuse of dominance, competition law, art. 102 TFEU, railways, regulation, DMA, excessive pricing, unfair pricing, private enforcement, stand alone claims

Case C-721/20 – DB Station & Service – Can secondary legislation limit the private enforcement of art. 102 TFEU?

Last month the CJEU delivered an interesting ruling on the scope of application of art. 102 TFEU when dealing with excessive or unfair prices in the railway sector. A first reading of the final conclusion of the CJEU would give the impression that the scope of application of art. 102 TFEU is being unduly restricted with this case by making […]

Melden Sie sich für unseren Newsletter an, um regelmäßig über unsere kommenden Konferenzen, Lexxion Trainings, Vor-Ort-Workshops und die neuesten Veröffentlichungen von Lexxion informiert zu werden.

Verpassen Sie keine Neuigkeiten und abonnieren Sie unseren kostenlosen Newsletter. Jetzt anmelden!