On February 6, 2019, the German Federal Cartel Office (“FCO”) prohibited Facebook’s practice of collecting and processing user data from Facebook’s own services as well as from third-party services without users’ freely given consent. After an investigation of nearly three-years, the FCO found that this practice amounted to an exploitative abuse of a dominant position. For the first time, the FCO considered compliance with data protection rules in its abuse of dominance analysis.
Under Facebook’s current terms of service, users can only join the social network if they also agree to Facebook’s practice of collecting and combining data with users’ Facebook profiles obtained from sources other than Facebook’s core platform (Facebook.com). These other sources include both Facebook-owned platform services (such as WhatsApp and Instagram), and third-party websites and apps with embedded Facebook interfaces. These websites and apps may share user data with Facebook even when a user does not actively use these functions or has disabled the browser’s or mobile device’s tracking features.
Dominant Position on the German Market for Private Social Networks
The FCO found Facebook to be dominant on the German market for private social networks. It considered Facebook’s platform an intermediary on a multisided market with free services, connecting private users with advertisers, publishers and developers. The FCO delineated a separate market for private social networks and excluded career-oriented professional social networks such as LinkedIn and Xing, messaging services such as WhatsApp, and other social media such as YouTube, Twitter, Snapchat, Pinterest and Instagram. The FCO further found the market to be limited to Germany, as users use social networks mainly to network with other users in the same country.
The FCO based its dominance finding not only on Facebook’s high market share of over 95% (in terms of daily active users), but also on a number of other criteria that the German legislature only recently introduced for the assessment of market power on multisided markets. In particular, the FCO found Facebook to profit from significant direct network effects due to Facebook’s large number of users (social networks are more attractive to users with an increasing number of other users, thereby making it very difficult for users to switch to other social networks – so-called “lock-in effect”), and indirect network effects encountered with Facebook as an advertising funded service (in parallel to Facebook’s large number of users, its attractiveness for commercial advertisers increases) that both create high entry barriers for other social networks. In addition, the FCO took into account Facebook’s access to users’ personal (i.e., competitively relevant) data. Interestingly, the FCO held that continuous innovation in the online sphere did not generally preclude it from considering a company dominant.
Abuse of Dominance
The FCO stressed that for the assessment whether Facebook’s data collection and processing practices constituted an exploitative abuse, it only applied the German, but not the European abuse of dominance provision, since it based its decision on German Federal Court of Justice (“FCJ”) case law. This case law held that inappropriate contractual terms and conditions agreed upon in an imbalanced negotiation and infringing German civil law or constitutional rights could constitute an exploitative abuse under German competition law. The FCO took the position that to assess whether contractual terms and conditions are inappropriate, the FCJ’s case law must apply to all legal principles which aim to protect a contracting party in an imbalanced negotiation position.
The FCO held that the EU General Data Protection Regulation (“GDPR”) constituted a suitable legal standard for determining whether data protection violations are competitively relevant. The GDPR aims to protect the right of informational self- determination and ensuring that users can decide freely, and without coercion, on how their data is used. The FCO also found that the data protection authorities’ primary responsibility of enforcing the GDPR does not preclude the FCO from considering the GDPR in its competitive assessments.
The FCO took the position that Facebook exploited its dominant position by requiring users wanting to join Facebook’s social network, to consent to the collection and processing of data from its own services as well as from third-party platforms. It concluded that this practice violated data protection law, as the users’ consent did not qualify as freely given – a requirement for its validity under the GDPR: Potential users wishing to join the social network had to either agree to the data collection/processing practice or refrain from using Facebook entirely. The FCO also found that the amount of data Facebook collected from its multitude of sources and combined into user profiles was neither necessary to perform any contractual obligations to users, nor did Facebook’s legitimate interests outweigh the interest of users in protecting their data.
According to the FCO, it was not necessary to analyze whether Facebook’s data collecting and processing practices were only made possible because of its dominance and that competitors, for this reason, would not be able to apply similar practices. The FCO considered it sufficient to find Facebook’s practices and violation of data protection law a manifestation of its market power.
Obligations Imposed on Facebook
The FCO ordered Facebook to discontinue the collection of user data from third-party platforms without user’s freely given consent within 12 months, and to develop an implementation roadmap for the FCO’s requirements within the next four months. Going forward, Facebook may continue to collect user data from its own services (including WhatsApp and Instagram), but may only combine these data with Facebook user accounts if users have provided their freely given consent to do so. In relation to data originating from third-party websites, freely given user consent is required for the collection and the processing of user data. The FCO stressed that “[v]oluntary consent to their information being processed cannot be assumed if their consent is a prerequisite for using the Facebook.com service in the first place”. The FCO refrained from imposing a fine at this point, but it may initiate a fines proceeding in the case of recurrent abusive behavior.
The FCO’s decision had been eagerly awaited by practitioners, not only because the FCO applied the recently introduced criteria for the assessment of market power on multisided markets, but in particular because of the FCO’s theory of harm which, for the first time, includes compliance with data protection rules into the assessment of abuse of dominance.
The FCO’s decision shows a current trend to closely scrutinize general business terms and conditions of companies with strong market positions. It also marks a first step by the FCO to engage tech companies collecting large amounts of data from a competition law perspective. The FCO clearly considers access to personal data to be the decisive resource defining incumbency for tech companies. The FCO’s president, Andreas Mundt, described the obligations imposed on Facebook as a form of “internal unbundling”; thereby limiting Facebook’s future use of user data for its, e.g., targeted advertising activities or other services. The Facebook decision could therefore become a blueprint for other abuse proceedings in digital platform markets. While the FCO stressed that it liaised closely with the European Commission and other competition authorities, it nonetheless remains to be seen whether the other authorities would follow the FCO’s decision in light of the specific German case law underlying the FCO’s approach.
Facebook has already appealed the FCO’s decision to the Düsseldorf Court of Appeals (Oberlandesgericht Düsseldorf, “DCA”) and, in addition, requested the court to suspend the decision’s effects in the interim.
 FCO Press Release, “Bundeskartellamt prohibits Facebook from combining user data from different sources”, February 7, 2019, available in English here, FCO Case Summary (B6-22/15), “Facebook, Exploitative business terms pursuant to Section 19(1) GWB for inadequate data processing”, February 15, 2019, available in English here, and FCO Background Paper, “Bundeskartellamt prohibits Facebook from combining user data from different sources – Background information on the Bundeskartellamt’s Facebook proceeding”, February 7, 2019, available in English here. A non-confidential version of the decision is available in German only here.
 Such as “like” or “share” buttons, “Facebook logins”, or analytics services implemented through “Facebook Pixel” or mobile software development kits.
 The FCO refers to the European Commission’s Facebook/WhatsApp (Case COMP/M.7217), decision of October 3, 2014, that separated consumer communication services from social networks, para. 15, available here. However, the FCO stated that even if YouTube, Snapchat, Twitter, WhatsApp, and Instagram were to be included in the relevant market, Facebook would still be presumed to be dominant.
 The FCO based its decision on the general provision of Section 19(1) of the German Act against Restraints of Competition (ARC).
 VBL-Gegenwert (KZR 47/14), FCJ decision of January 24, 2017, and Pechstein (KZR 6/15), FCJ decision of June 7, 2016.
 The FCO also found that these practices provided Facebook with a competitive advantage to the detriment of its competitors, thereby further increasing the existing barriers to entry.
 FCO Case Summary, p. 11.
 For example, the FCO recently (in November 2018) also initiated proceedings regarding Amazon’s terms and conditions and its behaviour vis-à-vis the retailers on its German marketplace platform amazon.de.