When competition law met data protection: the Bundeskartellamt’s Facebook decision

On February 6th, the German Competition Authority (Bundeskartellamt or BKA) adopted its long-awaited Facebook decision, imposing far-reaching restrictions on how the social network can collect and process user data. This decision follows a preliminary assessment that the BKA published in December 2017, which this blog discussed at length.

The BKA’s decision—as set out in a case summary and background paper—sticks closely to its preliminary assessment. In this blog post, I therefore recap what the case was exactly about, discuss what the current decision means, and look forward to what’s on the horizon for Facebook.

The issue: Facebook’s data processing

The BKA started a case against Facebook based on the way the social network collects and processes user data. The authority has not been concerned with the treatment of data generated by the use of the social network itself (termed ‘on Facebook’). After all, ‘the provision of a social network aiming at offering an efficient, data-based business model funded by advertising requires the processing of personal data. This is what the user expects.’

What the authority takes issue with is how Facebook collects and processes data from third-party apps and websites (‘off Facebook’). Firstly, Facebook collects data from its daughter apps WhatsApp and Instagram. Remember that in the course of merger proceedings, Facebook once declared it would be technically infeasible to match users’ Facebook and WhatsApp accounts in order to better target ads on Facebook. When that appeared easier than expected, the Commission fined Facebook €110M for providing misleading information.

Secondly, Facebook collects data from any website that uses ‘Facebook Business Tools’, which is any website where you can ‘like’ or ‘share’ content, where you can log in through your Facebook account, or that uses Facebook’s analytics services. When users spend time on such websites, this data is also added to their Facebook profile, leading—again—to more targeted advertisements.

When it comes to these ways of collecting user data from outside the social network, the BKA holds that ‘the efficiencies in a business model based on personalised advertising do not outweigh the interests of the users’. Indeed, users are unaware of such data collection and have not consented to it.

The legal analysis: when competition law met data protection

As this concerns an abuse of dominance case, the BKA goes through the traditional steps of defining the relevant market, establishing Facebook’s dominant position on it, and laying out a theory of abuse.

Market definition

The BKA defines the relevant market as the social network market in Germany. In doing so, it explicitly recognizes Facebook as a multi-sided platform serving users on the one hand, and advertisers running targeted advertisements on the other. Of these two sides, however, the authority considers the user side a separate market, which is in line with scholarship on the issue. The fact that users make use of Facebook for free is not a problem, as the recently inserted §18(2a) of the German Competition Act makes it clear that ‘[t]he assumption of a market shall not be invalidated by the fact that a good or service is provided free of charge.’

According to the BKA, Facebook does not face a lot of competition in the social network market. Now that Google is shutting down its Google+ social network, all that’s left is a number of smaller German providers. Other online services commonly referred to as ‘social media’ are not included in the market, as they are not interchangeable enough from a consumer point of view. Professional networks such as LinkedIn, messaging services such as WhatsApp or Snapchat, or other social media such as Instagram, YouTube or Twitter are therefore excluded from the market.

Market power (dominant position)

When it comes to market power, the BKA focuses on the fact that ‘Facebook’s user-based market share is very high, especially among daily active users, where Facebook has a market share exceeding 95%.’ To be safe, the authority also notes that the services of the Facebook group ‘would have a combined market share far beyond the market dominance threshold’ even if one would include YouTube, Snapchat, Twitter, WhatsApp, and Instagram in the relevant market.

According to the BKA, this won’t change any time soon. While competitors are leaving the market, Facebook’s user figures keep rising (or at least stagnate at a high level). This ‘strongly indicate[s] a market tipping process which will result in Facebook.com becoming a monopolist.’ The main reason for such tipping is found in direct network effects, which imply that users benefit most from being active on the platform where most of the other users are active.

In addition, the BKA examines other factors affecting a multi-sided platform’s market power, including indirect network effects leading to barriers to entry, access to competitively relevant data, and innovation-driven competitive pressure (the relevance of all of these factors is explicitly recognized in the recently inserted §18(3a) of the German Competition Act). Taken together, the BKA concludes Facebook is in a dominant position.

Abuse of dominant position

When it comes to the actual abuse, the BKA holds that ‘[u]sing and actually implementing Facebook’s data policy, which allows Facebook to collect user and device-related data from sources outside of Facebook and to merge it with data collected on Facebook, constitutes an abuse of a dominant position on the social network market in the form of exploitative business terms’. In specifying the exact nature of the abusive behaviour, the BKA relies heavily on the General Data Protection Regulation (GDPR).

Firstly, the BKA takes great care to justify its reliance on the GDPR to establish a competition law infringement. After all, the European Commission’s position is that ‘any privacy-related concerns […] do not fall within the scope of the EU competition law rules but within the scope of the EU data protection rules.’

Instead of focusing on the Commission’s position, the Bundeskartellamt relies on the case law of the German Federal Court of Justice, which considers contract terms abusive if they violate the German Civil Code (in particular when such terms are imposed by a party with superior power). By analogy, the BKA holds that ‘the European data protection regulations […] can or, considering the case-law of the highest German court […], must be considered when assessing whether data processing terms are appropriate under competition law.’ As the GDPR does not aspire to full consistency of enforcement, competition authorities can also consider and interpret its provisions.

More specifically, then, Facebook’s terms and conditions violate the GDPR as there is no effective consent for such extensive processing of data pursuant to Article 6(1a). The problem lies in the voluntary nature of the consent, which cannot be assumed if such consent is a prerequisite for using Facebook in the first place. The problem, in other words, is that when users want to use Facebook, they don’t have a choice except than to accept all terms and conditions.

‘Ok, so there’s a violation of the GDPR—how is this a competition issue?’, one might wonder. The BKA argues that the infringement of data protection law is ‘a manifestation of Facebook’s market power’. There is a link of causality: because Facebook inappropriately processes user data, it has ‘gained a competitive edge over its competitors in an unlawful way and increased market entry barriers, which in turn secures Facebook’s market power towards end customers.’


The BKA orders Facebook to adapt its data policies. Facebook can no longer combine the data it collects from WhatsApp and Instagram with Facebook user accounts without obtaining voluntary consent. (When collecting data from third-party websites, such voluntary consent is already required.) According to the BKA, ‘voluntary’ means that ‘the use of Facebook’s services must not be subject to the users’ consent.’ Without such consent, it can only combine data from various sources to a highly restricted extent. Facebook was given twelve months to implement the necessary changes, but its appeal to the Düsseldorf Higher Regional Court may suspend this deadline.

Commentary: unnecessarily blurring the lines?

Of course, this decision has faced a lot of criticism. Facebook itself is evidently not amused; in a blog post, the company has set out how it believes the BKA ‘underestimates the fierce competition we face in Germany, misinterprets our compliance with GDPR and undermines the mechanisms European law provides for ensuring consistent data protection standards across the EU.’

It is fair to question whether the decision unnecessarily blurs the lines between competition and data protection law. The connection between the two, which the BKA finds in Facebook’s market power, is somewhat tenuous. Indeed, as Justus Haucap remarks, ‘there is little evidence that would suggest that larger firms violate data protection and privacy standards in a more systematic fashion than smaller firms – if at all, the contrary appears to be true.’

It is unclear whether there are other factors motivating the BKA. In the past, EU competition law has been used to compensate for sleepy regulators. Is a similar dynamic at play here? According to the GDPR’s enforcement mechanism, the Irish data protection supervisor is responsible for scrutinizing Facebook’s data policies. Such supervisors are far from toothless: they have the power to impose fines worth up to 4% of the total worldwide annual turnover of the infringer. Was the BKA unhappy with the lack of action on the part of the Irish data protection supervisor?

Looking ahead: more cases, and what about Facebook’s data integration ploy?

Two other questions remain. Firstly, will the BKA’s precedent be followed by other competition authorities? The Commission’s response, for one, was lukewarm. A spokesperson said it ‘took note’ of the decision and is ‘closely following’ the BKA’s work, adding that ‘[t]he European legislator has made sure that there is now a regulation in place that addresses this type of conduct’, namely the GDPR. Commissioner Vestager has also stated that she doesn’t believe the Facebook decision can serve as a template for EU action as it sits ‘in the zone between competition law and privacy’ and was based in part on German law.

Secondly, what does the BKA’s decision means for Facebook’s plans to integrate Facebook, WhatsApp and Instagram? According to a recently announced plan, the company will unify the underlying technical infrastructure of the various apps, which will make cross-platform communication possible. While the BKA’s decision is geographically limited to Germany, it at least presents an additional technical challenge for an already ambitious plan.



Friso Bostoen

Blog Editor

Postdoctoral Researcher, KU Leuven

>> Friso’s CoRe Blog posts >>

Leave a Reply

Related Posts

15. Nov 2022
Features by Daniel Mandrescu
abuse of dominance, competition law, art. 102 TFEU, railways, regulation, DMA, excessive pricing, unfair pricing, private enforcement, stand alone claims

Case C-721/20 – DB Station & Service – Can secondary legislation limit the private enforcement of art. 102 TFEU?

Last month the CJEU delivered an interesting ruling on the scope of application of art. 102 TFEU when dealing with excessive or unfair prices in the railway sector. A first reading of the final conclusion of the CJEU would give the impression that the scope of application of art. 102 TFEU is being unduly restricted with this case by making […]
27. Oct 2022
Features by Daniel Mandrescu
tv broadcasting; competition law; art. 102 TFEU; antitrust; merger control

Opinion of AG Kokott in Case-449/21 (Towercast): filling gaps in EU merger control and creating new routes for dealing with killer acquisitions through the DMA 

Earlier this month AG Kokott delivered an opinion that quickly caught the attention of the (EU) competition law community. It covered a matter which has long been left unaddressed after the introduction of EU (and national) merger control rules, namely the possibility to apply art. 102 TFEU to concentrations.  According to AG Kokott, this possibility, which has been thought to […]
26. Apr 2022
by Enrico Di Tomaso

Eventim/Ticketone v. AGCM – May acquisitions be prosecuted pursuant to Article 102 TFEU?

With judgment no. 3334 of 24 March 2022, the Rome Administrative Court of 1st instance (TAR Lazio-Roma) has annulled the decision issued by the Italian Competition Authority (“AGCM”) on 22 December 2020, no. 28495. The above TAR Lazio judgment (“the “Judgment”) is noteworthy because it deals with the possibility of AGCM (and of national competition authorities at large) to apply […]
01. Apr 2022
Features by Friso Bostoen

The French judgment on Google’s Play Store: a shift towards platform exploitation?

On 28 March 2022, the Commercial Court of Paris fined Google €2 million for the imbalanced terms and conditions of its Play Store. While the fine is minimal, Google is also obliged to adapt those T&Cs, including the 30% fee—a much more far-reaching implication. Except for some news articles, the French judgment did not receive a lot of attention (which […]
08. Mar 2022
Features by Daniel Mandrescu

The DMA and EU competition law: complementing or cannibalizing enforcement?

The proposal of the DMA signals a significant change with respect to the application and enforcement of EU competition policy to online platforms. Despite the clear synergy between the two frameworks, the European Commission insists that the DMA is introduced with the idea of complementing, rather than replacing, the enforcement of EU competition law in the case of online platforms. […]
18. Jan 2022
Features by Daniel Mandrescu
smartphone menu

The Apple App Store case in the Netherlands – a potential game changer

Just before 2021 ended, Apple suffered a loss in the Netherlands where a national court in preliminary relief proceedings struck down its attempt to block the remedies imposed by the Dutch competition authority following a finding of abuse of dominance. As a result, as of last weekend, Apple is forced to accept third-party payment solutions implemented in (paid) dating apps […]
19. Apr 2021
Features by Friso Bostoen
Article 22, Merger Regulation, European Commission, Guidance, killer acquisitions, GAFAM

The Commission’s Article 22 EUMR Guidance: catching killer acquisitions through the merger referral procedure?

Over the past five years, the EU’s merger control regime has been hotly debated. The main concern driving the debate has been the intensive acquisition activity in the tech and pharmaceutical sectors. However, many of those acquisitions escape the jurisdictional thresholds of the EU Merger Regulation (EUMR) and therefore cannot be reviewed by the European Commission (EC). On 26 March […]
06. Apr 2021
Features by Daniel Mandrescu
competition law, art. 102 tfeu, online platforms, data sharing, refusal to supply

Online platforms and the essential facility doctrine – a status update following Slovak Telekom and the DMA

The recent judgment of the CJEU in Slovak Telekom provides important guidance on the application of the Bronner case law in cases concerning abusive market access obstacles. Such guidance is of particular value in the context of online platforms, where issues of access have been considered being unsolvable because of the stringent criteria of the refusal to supply case law. […]
03. Dec 2020
Features by Daniel Mandrescu

Why you (often) don’t need the essential facility doctrine in the digital economy? – Interpreting Lithuanian Railways and Slovak Telekom

The insights from Lithuanian Railways and Slovak Telekom may have serious implications for the application of the Oscar Bronner case law in the future. These insights may prove, however, to have the most value in the digital economy where it would appear that the essential facility doctrine might often not even be needed – not even in the case of […]
26. Nov 2020
Features by Daniel Mandrescu

Lithuanian Railways and Slovak Telecom – Implications for the Essential Facility Doctrine

The recent cases of Lithuanian Railways and Slovak Telekom address the matter of refusal to deal. Both cases, which do not engage in the assessment of this abuse, in fact, provide important guidance on the scope of application of the essential facility doctrine for current practice that will be covered in this post. Refusals to deal and the essential facility […]

If you are interested, please use our Newletter to stay informed about our upcoming conferences, workshops, trainings and current published journals in our core areas of EU competition, data protection, substances and environmental law, as well as exciting new projects in emerging technologies and digitalisation.

Don’t miss any news and sign up for our free news alert.  Sign up now