Excessive Data Collection as a Form of Anticompetitive Conduct: The German Facebook Case

A. Facts and Procedural Background

Facebook is the provider of a worldwide digital social network service, which has been available in Germany since 2008. By 2018, Facebook’s user base in Germany had grown to 23 million daily and 32 million monthly users. ³⁴ The network was primarily financed through online advertising and was free of charge for private users. However, Facebook required users to register with the network and set up a user profile. Both registration and use of the network were subject to numerous terms and conditions. Most importantly, Facebook required users to authorize it to process their personal data as specified in its data and cookie policies. In essence, private users who agreed to these terms allowed Facebook to collect, combine, and analyze user-generated data from a number of different online sources, namely, data generated on (1) Facebook.com itself, (2) any other Facebook-owned service, and (3) any third-party websites that used “Facebook Business Tools.” Users of the social network were, in theory, able to establish which services Facebook owned by clicking on a link contained in Facebook’s terms of service. ³⁵ By contrast, it was more difficult for them to ascertain which third-party websites used Facebook Business Tools—tools and products that Facebook made available free of charge to third-party website operators, developers, advertisers, and other businesses for integration into their own websites, apps, and online offers. They included social plugins (“Like” or “Share” buttons), Facebook login, and other analytics services (Facebook Analytics). According to the FCO, “millions” of businesses used Facebook Business Tools at the time of the investigation. ³⁶ They were—unsurprisingly—not individually listed in Facebook’s terms and conditions, and users could not know whether a website had embedded them before they accessed it for the first time. Some Facebook Business Tools remained invisible to users even after they accessed the website.

This practice allowed Facebook to track individuals’ movements (both geographically and online) and collect detailed data about the users of its social media network, as well as individuals who were not registered with Facebook but visited third-party websites that integrated Facebook business tools. It thus established a vast database of highly detailed user profiles, including information such as names, age, gender, photos, friends, locations, shopping behavior, interests, political views, and sexual orientation, among many others. ³⁷ This information allowed Facebook to sell targeted online advertising services to businesses by matching the ad to individual profiles. In 2018, Facebook generated 98% of its worldwide US$55 billion profit from advertising. ³⁸

The FCO formally initiated proceedings against Facebook on March 1, 2016. On February 6, 2019, almost three years after opening proceedings, it issued a decision finding that Facebook had abused a dominant position by collecting, combining, and analyzing user data from the abovementioned three sources and required Facebook to make far-reaching changes to its data collection policy.

B. The FCO’s Infringement Decision

C. The Appeal

The FCO’s decision triggered a wide range of reactions. Some commentators were skeptical or even outright critical. Recurring views among this group were that, from an economic point of view, all parties were better off as a consequence of Facebook’s business model, that the ability to collect data was unrelated to market power, and that empirical evidence suggested that many users willingly shared their data to obtain better services. ⁹⁸ Others applauded the FCO’s decision as a brave and necessary attempt to tackle a genuine problem. ⁹⁹

In any event, the FCO’s victory was initially short-lived. Facebook appealed the decision to the Düsseldorf Higher Regional Court ¹⁰⁰ and applied for interim relief, asking the court to order suspensive effect of the appeal. ¹⁰¹ The court granted this request because of serious legal doubts. ¹⁰² It detailed its concerns in a thirty-seven page, forcefully worded opinion that, at times, read more like a final judgment than a summary review, and stated in no uncertain terms that even a summary examination of the factual and legal arguments showed that the FCO’s decision would have to be annulled in the main proceedings.

The court considered three possible types of abuse and found that the FCO had not proved any of these to the required legal standard: (1) excessive pricing or other unfair contractual conditions, (2) exploitation by dictating unlawful contractual conditions, and (3) an exclusionary abuse.

The FCO had in fact not based its decision on the first or the third theories of harm but had relied exclusively on the second concept of abuse examined by the court. The court nonetheless briefly explained why there was insufficient evidence for either of these alternatives. In relation to the possibility of excessive pricing or unfair conditions, it found that the FCO had not established the counterfactual required for proving this type of abuse. In other words, the FCO had not shown that prices were higher or contractual terms less advantageous than would have been the case in a competitive market. ¹⁰³ Regarding the potential exclusionary abuse, it engaged with the FCO’s very rudimentary and highly theoretical statements relating to the effects of Facebook’s conduct on competition that the agency had made in passing when assessing the causality of Facebook’s position of dominance for its exploitative conduct. ¹⁰⁴ Not surprisingly, it found that the FCO’s evidence was not even remotely sufficient to support the assumption that Facebook’s data collection foreclosed competition on the market for social networks or that there was a danger of Facebook transferring its market power to the market for online advertising or any of the other markets on which Facebook-owned services were active. ¹⁰⁵ Interestingly, the court also did not deem the capacity to foreclose or a likely foreclosure effect sufficient for such an abuse, but held that sec. 19 (2) no. 1 GWB required an actual foreclosure effect. It argued that this requirement was widely recognized in the case law and academia, but only cited its own case law in support of this view. ¹⁰⁶ This is a different standard than that applied by the European Court of Justice to exclusionary abuses, which does not require an actual foreclosure effect, but considers a likely foreclosure effect or the capacity to foreclose sufficient under Article 102 TFEU. ¹⁰⁷

The focus of the court’s review was the FCO’s claim that Facebook had abused its dominant position by forcing illegal contractual conditions upon its users. ¹⁰⁸ It did not object to the FCO’s definition of the relevant market. Nor did it fault the finding that Facebook was dominant in this market. ¹⁰⁹ However, it strongly disagreed with the FCO’s assessment of Facebook’s conduct. At the outset, the court acknowledged that one could “not entirely exclude” the possibility that an infringement of consumer protection law could amount to abusive behavior within the meaning of sec. 19(1) GWB. This followed both from the case law of the German Federal Court of Justice ¹¹⁰ and that of the European Court of Justice on Article 102 TFEU. ¹¹¹ It also conceded that the wording of sec. 19 GWB and of Article 102 TFEU both explicitly recognized the concept of exploitative abuse.

That being said, the Düsseldorf court unequivocally rejected the FCO’s findings that Facebook had committed such an abuse because, in its view, the FCO had not established that Facebook had engaged in “anticompetitive conduct,” that is, conduct that resulted in “anticompetitive effects.” ¹¹² Facebook users had not suffered any economic loss from the transfer of data, as personal data were duplicable and could be shared by users with an infinite number of other undertakings. ¹¹³ The FCO had also not proved that users had been required to share an “excessive” amount of personal data of a commercial value. ¹¹⁴ Finally, contrary to the FCO’s findings, consumers had not “lost control of their data,” ¹¹⁵ because they had knowingly and willingly agreed to the transfer of this data. Facebook had not coerced or pressured users into agreeing to the terms and conditions, nor had it pried on the weak-minded or engaged in any other unconscionable conduct. Users had simply weighed the pros and cons of sharing their personal data, and had done so freely, in line with their own preferences. This was proved by the fact that 32 million German citizens used Facebook, whereas around 50 million had chosen not to because they had reached a different conclusion in this cost-benefit analysis. The court also strongly disagreed with the FCO’s assessment that users did not understand the extent to which Facebook collected and used their data, as, in its view, Facebook’s terms and conditions were perfectly clear on this point. If users chose not to read these, this was due to indifference or laziness, but not compulsion.

The court further dismissed the FCO’s argument that individuals could suffer relevant harm through identity theft, fraud, or blackmail. The FCO had neither provided evidence for this claim, not was this the type of harm that competition law sought to prevent. Rather, this was a matter for data protection law. Also, the FCO had failed to explain why Facebook’s practice of combining data from different sources was more likely to result in this type of harm than merely collecting sensitive data from the core social network.

Lastly, the court considered whether an anticompetitive effect could be inferred from the fact that Facebook had allegedly breached the GDPR. ¹¹⁶ It left open whether Facebook had actually infringed the GDPR because it considered this point irrelevant. The court reiterated that exploitative conduct could only be abusive within the meaning of sec. 19(1) GWB if the undertaking engaged in conduct that harmed competition. ¹¹⁷ This followed from the wording of the provision, which outlawed the “abuse of a dominant position,” and its legal objective, which was to protect the “freedom of competition.” ¹¹⁸ The requirement of anticompetitive conduct was also the reason why the test for excessive pricing required the FCO to establish a counterfactual. The same requirement had to apply to any other type of exploitative abuse within the meaning of sec. 19(1) GWB. Hence, a mere breach of statutory law by a dominant undertaking could not possibly constitute a sufficient basis for considering its conduct abusive. Such an approach would also be unfair toward individuals whose data protection rights had been breached by a nondominant undertaking.

The court left open whether a breach of the GDPR could be deemed anticompetitive if the position of dominance had been causal for the statutory breach, as, in its view, the FCO had failed to establish causality to the required standard. According to the court, any exploitative abuse required strict, and not merely “normative,” causality between the position of dominance and the conduct. In its view, this was implied in the case law of the European Court of Justice, in particular the principle established in Hoffmann-La Roche that dominance was problematic because it enabled the dominant undertaking to prevent effective competition being maintained on the relevant market by affording it the power to behave to an appreciable extent independently of its competitors, its customers, and ultimately of the consumers. ¹¹⁹ Likewise, the case law of the German Federal Court had to be interpreted as prescribing a standard of strict causality for exploitative abuses. ¹²⁰ The only relevant question therefore was whether the average user’s consent at the time of registration was influenced by Facebook’s position of dominance to such an extent that it could no longer be considered an autonomous decision. ¹²¹ According to the court, the FCO had not proved that this was the case. Consumers were not in a position of dependency vis-à-vis Facebook. They had freely decided to make their personal data available in exchange for a free, advertising-financed service. Further, the social network service was not indispensable for users’ everyday life but merely allowed them to communicate with friends, family, or other third parties. The fact that 50 million German citizens did not use Facebook proved that there were alternative ways of communication.

The court concluded its review with a few choice words of skepticism about the “privacy paradox” cited by the FCO. In its view, the fact that 75% of Facebook users questioned in the FCO’s survey had expressed the opinion that they cared how a social network work handled their data, but had nonetheless agreed to Facebook’s terms, was not evidence of market power. Moreover, the fact that over 80% of users ¹²² had stated that they had not read Facebook’s data policy before agreeing to it was also not evidence of Facebook’s market power, but more likely explained by a lack of time, interest, or sheer laziness. None of these possible explanations could affect the validity of their consent. ¹²³

D. Further Appeal

The FCO appealed against the Düsseldorf Higher Regional Court’s interim order to the Federal Court of Justice, ¹²⁴ the highest court in the German ordinary jurisdiction. On June 23, 2020, in a ruling that took the German competition community rather by surprise, ¹²⁵ the Federal Court of Justice annulled the Higher Regional Court’s interim order. ¹²⁶ The five-judge panel, which was formally only ruling on whether the Higher Regional Court had been right to order suspensive effect of the appeal, made clear that it had no doubt at all that Facebook was abusing its dominant position. It also explained its take on key substantive issues in this interim ruling, which is highly unusual. While not explicitly rejecting the FCO’s privacy-based concept of harm, it suggested a slightly different approach. In its view, the relevant issue was “not so much” the infringement of the GDPR, but users’ lack of choice between (1) a more personalized experience on Facebook, that might indeed require extensive data collection from all three sources and (2) a less personalized experience, based on the data that consumers choose to disclose on Facebook.com. This lack of choice, the Federal Court ruled, “not only” affected users’ autonomy and right to privacy, but it was also exploitative because Facebook was denying consumers a service for which there was demand, and which a competitive market would likely have provided, that is, a less personalized and less invasive social network service. The Federal Court further specified that Facebook’s data collection policy, in its view, was entirely capable of affecting competition. It saw a likely restrictive effect (1) on the market for social networks, because Facebook’s data collection further increasing the lock-in of users, and the data collection allowed Facebook to provide attractive advertising services, which financed the social network and (2) on the market for online advertising. It explicitly criticized the Higher Regional Court for erroneously assuming that the restrictive effect had to occur in the market in which the undertaking was dominant. The ruling, incidentally, did not address the issue of causality, which had played such a key role in the Higher Regional Court’s reasons for granting Facebook interim relief.

To be clear, the Federal Court’s order of June 23 merely annulled the Düsseldorf Higher Regional Court’s decision to order suspensive effect of the appeal. The main proceeding now continues in the Düsseldorf court, which would be well advised to take on board the interpretative suggestions of the Federal Court of Justice. Whichever party loses can then appeal against this judgment to the Federal Court of Justice again. The proceedings are likely to continue for several years. In the meantime, Facebook has to comply with the prohibition, meaning that it may no longer operate its current data collection policy in Germany.

E. Legislative Aftermath

In a further plot twist, the German government has meanwhile also joined the fray. On October 10, 2019, just over a month after the Higher Regional Court’s order condemning the FCO’s decision, the federal government published a new legislative proposal to amend the German Competition Act, which is currently being considered by the legislator. ¹²⁷ The proposal promises to deliver a “focused, proactive and digital competition law 4.0” and proposes far-reaching changes to the law. This proposal was not specifically triggered by the Higher Regional Court’s order. The ministry had reportedly been working on the amendment since 2018 in response to an expert report recommending a number of legislative changes to facilitate the enforcement of German competition law against dominant platforms. ¹²⁸ However, the proposal explicitly engages with the FCO’s decision and the Düsseldorf court’s order. Far from criticizing the FCO’s approach, the document relies on the FCO’s findings and views as a basis for many of the proposed amendments. ¹²⁹ Even more importantly, the proposal firmly takes the FCO’s side in several of the contentious legal issues underlying the Facebook case and aims to correct the course set by the Düsseldorf court. Most significantly, the bill proposes to codify the standard of normative causality used by the FCO and rejected by the court for all types of exploitative abuse, including those resulting from unlawful contractual conditions imposed by a dominant undertaking. According to the ministry, the standard of normative causality follows clearly from the Federal Court of Justice’s case law and from the GWB’s legal objective, which is to protect autonomous decision-making in the market. ¹³⁰ The proposal also stresses that exploitative abuses could occur in situations where the harm inflicted upon users was not measurable in monetary terms but took the form of an unjustified transfer of personal data. In the context of digital platforms characterized by increasing market concentration, information asymmetries, and the “rational apathy” of users, the FCO had to be in a position to prohibit an exploitation even though it was typically not possible to develop a sensible counterfactual. The fact that even nondominant undertakings could act in a comparable manner did not make users less worthy of protection, especially as the dominant undertakings in these settings discouraged switching and encouraged competitors to copy their behavior. The legislative proposal cites the Düsseldorf Higher Regional Court’s order in the Facebook case as evidence of “legal uncertainty” on this point, which urgently requires legislative clarification. ¹³¹

A. Anticompetitive Conduct in the Absence of Foreclosure or Collusion?

The first question that arises is whether a dominant undertaking’s conduct can really be considered anticompetitive if the undertaking did not engage in conduct that restricted competition, be it in the form of foreclosure or collusion. In the United States, the answer currently is a clear no. ¹³³ However, as explained in Part II, EU and German competition law take a different position. ¹³⁴ The very wording of Article 102(a), (b) TFEU and sec. 19(2) no 2 GWB make clear that it is abusive for a dominant undertaking to impose unfair prices, other unfair trading conditions, or to limit output or innovation to the prejudice of consumers. Neither of these provisions requires that the detrimental effects for consumers be the consequence of foreclosure or collusion. Nor does the case law in either jurisdiction require this.

While the Düsseldorf court almost grudgingly recognized this in its opening statements, it was clearly uncomfortable with the very notion of sanctioning pure consumer exploitation under the competition rules, stressing again and again that the only purpose of competition law was to protect the freedom of competition, ¹³⁵ and that sec. 19(1) GWB therefore only prohibited “anticompetitive conduct.” ¹³⁶ This is somewhat reminiscent of the wording used by the U.S. Supreme Court in Trinko. ¹³⁷ However, it remains that both the authors of the European Treaties and the German legislator decided that it is a matter of competition law to ensure that a dominant undertaking does not use the absence of competition to extract excessive or unfair conditions from consumers.

B. Invasion of Privacy as Consumer Harm

The next issue on which the FCO and Düsseldorf court could not agree was whether Facebook’s conduct caused relevant consumer harm. Is privacy a parameter of consumer welfare within the meaning of competition law? And if so, did Facebook’s conduct result in a reduction of such welfare? Neither the FCO nor the Düsseldorf court explicitly defined the concept of harm, nor was the theory underlying either side’s arguments particularly clear. The only conclusion one can draw with certainty is that the two institutions strongly disagreed on whether Facebook’s conduct had resulted in relevant harm.

For the FCO, Facebook had harmed users by infringing their right to informational self-determination or privacy—legal rights guaranteed by the German constitution and the EU’s GDPR and Charter of Fundamental Rights respectively. The FCO inferred the violation of these rights from the fact that Facebook had infringed the GDPR. It did not rely on an economic concept of consumer welfare—it might have been possible to argue that privacy was an element of service quality—and outright rejected Facebook’s attempts to translate the implications of this infringement into quantifiable economic terms. One may conclude that it considered the infringement of a constitutionally guaranteed freedom in itself a relevant form of harm within the meaning of German competition law.

The Düsseldorf court disagreed. In its view, consumers had not suffered any relevant harm. They had not suffered any economic loss. They had also not lost control of their data because they had knowingly and willing agreed to Facebook’s terms and conditions after balancing the benefits and drawbacks of paying for Facebook’s free social network service with their data. The fact that some users were too lazy, busy, or indifferent to read these terms and conditions did not change the fact that they had agreed without coercion to the transfer of data. As it was clear to the court that users had willingly shared their data, it did in fact not engage with the fundamental question of whether an infringement of a constitutional right is a relevant form of consumer harm or whether competition law is limited to preventing instances of economic consumer harm.

The Federal Court of Justice, while not rejecting the FCO’s proposition that personal autonomy and privacy are protected by sec. 19 GWB, indicated that it was more inclined to focus on another type of harm: consumer choice and the prevention of a service for which there was demand. In its view, the key problem was that Facebook had denied consumers the choice between a more personalized but invasive network service and a less personalized but less invasive service. Thereby, Facebook denied certain consumers a service which they wanted and which a competitive market would likely have provided.

C. Causality

Another key point of contention between the FCO and the Düsseldorf court was the issue of causality. Even if one recognizes that both German and EU competition law outlaw exploitative abusive behavior in principle, under what conditions exactly does the welfare-reducing conduct of a dominant company become abusive and hence unlawful under the competition rules? In particular, must the absence of competition be causal for the welfare-reducing behavior? And if so, how does one prove this?

In fact, neither institution disputed that there had to be some form of causality between the position of dominance and the conduct. This is a sensible position, as otherwise any act on the part of a dominant undertaking that negatively affects consumer welfare would amount to abusive conduct. It is hard to make the case that harmful conduct, which is entirely unrelated to the absence of competition, should fall within the scope of competition law. The link with the objectives of competition law would become tenuous, in fact almost inexistent, in this kind of scenario, and competition law would become an all-purpose tool for punishing any harmful conduct by a dominant undertaking, just because it operates in a market in which competition is compromised. This would be neither reasonable nor would it be compatible with the general concept of exploitative abuses. In the words of United Brands, it is necessary to “ascertain whether the dominant undertaking has made use of the opportunities arising out of its dominant position in such a way as to reap trading benefits which it would not have reaped if there had been normal and sufficiently effective competition.” ¹³⁸ In other words, the absence of competition must have been causal for the harmful conduct.

However, while the FCO took the view that normative causality was sufficient, the Düsseldorf court required strict causality between the position of dominance and the conduct. In other words, the court took the view that the FCO should have established a counterfactual and proved that Facebook would not have been able to engage in the relevant conduct in a competitive market. In its view, nonpricing exploitative abuses had to be subject to the same rules as excessive pricing, and excessive pricing required establishing a counterfactual to prove that the dominant undertaking would not have been able to impose these prices in a competitive environment. Hence, it concluded that the FCO should have established that Facebook would not have been able to collect as much personal data if it had been subject to competitive pressure.

Could the FCO possibly have established a convincing counterfactual that would have proved on the basis of sound empirical evidence that a nondominant provider of social network services could not have inflicted the same harm on consumers? Evidence, in fact, suggests that the few nondominant competing providers of social network services were acting in a similar way. ¹³⁹ According to the FCO, however, this did not sever the causal link between the position of dominance and the unlawful data collection, as, in its view, the smaller competitors were acting under the umbrella of Facebook’s illegal conduct—similarly to nonparticipating fringe competitors being able to charge supracompetitive prices under the umbrella of a price-fixing cartel. ¹⁴⁰ This is an interesting argument. However, the FCO did not provide any further evidence for this claim. Alternatively, rather than rely on the conduct of nondominant competitors in the market for social network services, the FCO might also have tried to show that undertakings in comparable competitive data-driven markets, which were not dominated by one undertaking with significant market power, collected data in a way that did not violate the GDPR. It did not do so. One might indeed wonder whether competitive markets for free, adverting-financed online services even exist, given the propensity of such markets toward tipping. ¹⁴¹ In sum, the FCO did not provide any empirical evidence for the assumption that competition would have prevented Facebook from acting in a way that was incompatible with the EU data protection rules.

Instead, the FCO relied on the concept of normative causality. It did not define or explain this concept that was so central to its theory of harm. However, according to German scholarship, the concept of normative causality in the context of exploitation by means of unlawful contractual conditions refers to a situation in which the undertaking violates a legal provision that condemns the conduct precisely because the undertaking has a position of dominance. ¹⁴² One could therefore take the view that the FCO inferred the causal link from the fact that Facebook violated a piece of legislation that is itself based on the assumption that a position of dominance is likely to cause, or at least significantly contribute to causing, the relevant type of harm. Is this approach compatible with the German case law? There is currently no clear answer to this question. The FCO appeared to read the three judgments by the German Federal Court as inferring causality from the infringed legal provision. The Düsseldorf court interpreted the same judgments as clearly requiring a counterfactual. In fact, none of the cases explicitly mentioned or discussed the concept of causality. This is a question the German Federal Court would have to answer on appeal. Interestingly, it did not pronounce itself on the matter of causality at all when annulling the Düsseldorf Higher Regional Court’s order on June 23, 2020, even though it gave unusually detailed indications on the appropriate theory of harm in this interim procedure. However, the matter may soon be moot for the purposes of German competition law at least, if the German government’s proposal for the amendment of the GWB is enacted by the German Parliament, and the revised GWB explicitly prescribed normative causality as the appropriate standard for all types of exploitative abuse.

That being said, one may also wonder, whether the position of market dominance is really so central to the GDPR’s assessment criteria as to allow the conclusion that the GDPR presumes causality between market power and excessive data collection. In support of its view, the FCO first relied on (the legally nonbinding) recitals 42 and 43 of the Regulation, which do not actually mention the terms dominance or market power, but do state that consent should not be deemed freely given if there is a clear imbalance between the data subject and the data controller, in particular where the controller is a public authority. Facebook is not a public body and does not have the powers and authority of an organ of the State. However, there is a clear economic imbalance between Facebook and the average user. The FCO therefore additionally relied on the guidelines issued by the former “Article 29 Data Protection Working Party,” ¹⁴³ according to which an imbalance of power within the meaning of recital 43 is not limited to interactions with public authorities. The FCO’s second argument relates to the balancing of interests to be carried out under Article 6(1)(b) and (f) GDPR. Again, neither of these provisions explicitly mentions dominance or market power. Article 6(1) does specify, by contrast, that a public authority may not rely on the justification of Article 6(1)(f) GDPR at all. Instead, the FCO relied on an opinion of the former “Article 29 Data Protection Working Party” from 2014 on the equivalent provisions of the GDPR’s predecessor, ¹⁴⁴ according to which an imbalance of power needs to be considered in the balancing exercise. While it is thus possible to make the case, with the aid of legally nonbinding soft law instruments, that the GDPR considers an imbalance of power an important criterion for the purposes of assessing the validity of consent and other justifications, it would be a stretch to say that the GDPR explicitly and clearly presumes causality between a position of market power and excessive data collection. On the face of it, it expresses a stronger connection between public power and excessive data collection. Whether this is a sensible position in the time of data-driven mega platforms is another matter.

D. The Privacy Paradox

One last point on which the FCO and the Düsseldorf court did not see eye to eye is the existence and relevance of the privacy paradox. The FCO, being convinced that the privacy paradox was a genuine problem, used it as an additional argument to prove that Facebook had a position of dominance in the market for social networks, that is, the power to impose contractual data processing conditions that users did not want and would not have agreed to but for the unavoidability of Facebook as a trading partner. It therefore chose to step in and protect consumers against the consequences of their own actions. The Düsseldorf court, on the other hand, held that the privacy paradox, even if existed, was not evidence of Facebook’s dominance. In the absence of coercion and deceit, users had had the opportunity to make a fully informed decision and to weigh the benefits derived from using the social network against the cost of allowing Facebook to carry out extensive data collection and personal profiling. Around 50 million German citizens had chosen not to use Facebook, which proved that individuals reached different conclusions in this balancing exercise. In the court’s view, mere laziness or lack of interest on the part of the users, which led them not to read the terms and conditions, did not change the fact that they had freely consented. In other words, unlike the FCO, the court did not find this type of behavior worthy of protection and considered consumers fully responsible for their actions.

The privacy paradox has been studied from many different angles since the late 1990s, drawing in particular on social theory, psychology, and behavioral economics. A number of studies show a clear dichotomy between people’s beliefs on what is desirable and their actual behavior when it comes to the disclosure of personal data online. ¹⁴⁵ Other studies challenge the existence of a privacy paradox and claim that consumers’ beliefs and behaviors are more or less aligned. ¹⁴⁶ It would go beyond the scope of this article to explore the vast literature on the privacy paradox in detail. Suffice it to say that even among those scholars who agree that the phenomenon exists, there is no one universally accepted explanation for what exactly is causing it. ¹⁴⁷ Behavioral economists, for example, argue that people may not be able to act as economically rational agents when it comes to personal privacy, as privacy-related decisions are affected by incomplete information, bounded rationality (self-control problems and the need for immediate gratification), and other psychological biases. ¹⁴⁸ Others have primarily drawn on social theory to conclude that social networks have become such an important part of their users’ social lives that they feel compelled to disclose their personal information despite privacy concerns in order to maintain their social lives. ¹⁴⁹ These are just two among many different explanations. In sum, the privacy paradox appears to be a complex, user- and context-dependent phenomenon that requires further research. ¹⁵⁰

This uncertainty notwithstanding, the Düsseldorf Court’s assumption that Facebook’s preformulated contractual terms and business model were clear enough to allow the average Facebook user to make an informed and timely decision about the exact implications of their conduct, and easily balance the advantages and against its disadvantages, seems a little unworldly. After all, in February 2018, following a formal investigation, the EU Consumer Protection Cooperation Network found Facebook’s terms and condition to be insufficiently clear and required it to explain more clearly to consumers that they were not charged for using the platform because they paid for this service with their data, that Facebook used that data to create detailed profiles of its users, and that commercial firms paid Facebook to show targeted advertisements to users on the basis of that data. ¹⁵¹ Likewise, in November 2018, the Italian Antirust Authority found that Facebook’s slogan “sign up, it’s free, and always will be” breached several provisions of the Italian Consumer Protection Code and fined Facebook EUR 10 million for engaging, among others, in a “misleading practice” by failing to provide adequate information to consumers on how Facebook commercially exploited users’ data collected from the social network. ¹⁵²

A. The Right to Privacy as a Parameter of Consumer Welfare under EU Competition Law

The European Commission’s current interpretation of the EU competition rules suggests that it is unlikely to consider an infringement of the right to privacy a relevant form of consumer harm. Since the late 1990s, it has interpreted the EU competition rules as protecting consumer welfare in the economic sense of the term, ¹⁵⁶ which it primarily defines in terms of price, output, quality, and innovation. ¹⁵⁷ Constitutional freedoms, such as the right to privacy, do not fall within this objective. Moreover, the European Commission’s decisional practice since the advent of the digital economy does not suggest that it considers privacy a parameter of consumer welfare in the form of service quality. In the Facebook/WhatsApp acquisition from 2014, for example, the Commission explicitly stated that any privacy-related concerns flowing from the increased concentration of data within the control of Facebook as a result of the transaction would not fall within the scope of EU competition law but that of the EU data protection rules. ¹⁵⁸ Likewise, in the 2016 decision clearing Microsoft’s acquisition of LinkedIn, it merely assessed the potential competition concerns arising from the combination of personal data, that is, whether the transaction would give the merged entity a competitive advantage in the market for online advertising. It did not engage with the potential impact on consumers’ privacy and only touched on the GDPR in its capacity to restrict the parties’ data processing practices and hence as an additional argument against market power. ¹⁵⁹ The U.S. antitrust authorities currently take a similar stance. ¹⁶⁰

However, it is the European Court of Justice that has the final word in matters of interpretation. The Court has ruled on the relevance of privacy in competition law assessments only once to date. In Asnef-Equifax, a judgment from 2006, it was asked to give guidance on whether Article 101 TFEU prohibited financial institutions from setting up a credit information system that would allow them to exchange solvency and credit information on individual customers through the computerized processing of data. The Court ruled that this type of agreement neither had the object of restricting competition nor was it likely to have such an effect. Rather as an afterthought, it added that any possible issues relating to the sensitivity of personal data were not, as such, a matter for competition law, as they could be resolved on the basis of the relevant provisions governing data protection. ¹⁶¹ In sum, like the Commission, which may have taken its clue from this ruling, the Court took the view that privacy is not “as such” a competition issue.

That being said, Asnef-Equifax concerned a potentially anticompetitive agreement, which, according to Article 101 TFEU, requires a restriction of competition. And unquestionably, a restriction of privacy does not amount to a restriction of competition. However, the Facebook case concerns an exploitative abuse, which does not outlaw conduct for restricting competition, but for using a position of dominance to inflict harm on consumers in the form of unfair prices or other unfair trading conditions. The ruling in Asnef-Equifax did not pronounce itself on whether compelling an individual to agree to excessive data collection in violation of the GDPR could, or could not, be considered an unfair trading condition. Also, the judgment in Asnef-Equifax dates from 2006, when e-commerce was still in its infancy. As the Internet of Things has grown in importance, so have the understanding and concerns about the commercial use of personal data as a business model.

It may therefore well be that, in a future case, in which invasive data collection is the key investigated type of harm, the Court may clarify or revise this position. After all, it has never explicitly embraced all tenets of the European Commission’s more economic approach which reinterpreted the EU competition rules in light of the consumer welfare aim and resulted in the Commission employing a relatively narrow, price-centric understanding of competitive harm in practice. ¹⁶² In particular, the Court has never defined consumer welfare as referring to purely economic welfare to date. In fact, the Court has yet to formally endorse the exclusive consumer welfare aim. Instead, it has regularly adopted broader formulas, according to which the objective of the EU competition rules is to “prevent competition from being distorted to the detriment of the public interest, individual undertakings and consumers, thereby ensuring the well-being of the European Union” ¹⁶³ or to protect “not only the interests of competitors or of consumers” but also the “structure of the market and, in so doing, competition as such.” ¹⁶⁴ Likewise, the Court has not yet explicitly agreed with the Commission’s “more economic” reading that restrictions of competition are only problematic if they are bound to result in demonstrable consumer harm or that only economic efficiency effects can outweigh anticompetitive effects. On the contrary, it has repeatedly ruled that direct consumer harm is not an essential requirement of anticompetitive exclusionary conduct or export restrictions, ¹⁶⁵ and it has consistently defined the first condition of Article 101(3) as “appreciable objective advantages of such a kind as to compensate for the resulting disadvantages for competition.” ¹⁶⁶ The latter are therefore not explicitly limited to efficiency effects, or, in fact, even economic benefits. In sum, while the Court has never explicitly recognized privacy as a parameter of consumer welfare, there is nothing in the case law either that would explicitly rule out such an interpretation in the context of exploitative abuses.

Further, according to settled case law, fundamental rights form an integral part of the general principles of law the observance of which the Court ensures. ¹⁶⁷ It thus regularly interprets other areas of commercial law, such as the free movement rules, in light of EU fundamental rights. For example, it has held that fundamental rights, such as the freedom of expression, assembly, or the principle of human dignity, can act as limitations on the free movement of goods or services even if these aims are not explicitly listed in the relevant Treaty exemption. ¹⁶⁸ The case could therefore be made that the right to privacy should be considered when deciding whether data collection in violation of the GDPR amounts to an “unfair trading practice” within the meaning of Article 102(a) TFEU. That being said, such an assessment should then also consider Facebook’s commercial freedom and balance this against the individual user’s right to privacy. According to the German FCO, the Union legislator carried out such a balancing exercise and stipulated the outcome in a legally binding manner in the GDPR.

That being said, the theory of harm favored by the Federal Court of Justice, which focuses on the fact that Facebook was denying its users a choice between two types of service and was thus preventing the emergence of a new kind of service for which there was demand, appears more easily reconcilable with the case law of the European Court of Justice. Article 102(b) TFEU explicitly prohibits a dominant undertaking from limiting production, markets, or technical development to the prejudice of consumers, and the Court of Justice has repeatedly deemed that “preventing the appearance of a new product for which there is potential consumers demand” is a relevant factor for determining whether the conduct of a dominant undertaking is abusive. ¹⁶⁹

B. The Issue of Causality

The issue of causality is even less clear and a possible future ruling by the Court of Justice even more difficult to predict. If one looks at the European case law on excessive pricing, one sees that the Court, while requiring causality between the absence of competition and the high price, ¹⁷⁰ does not necessarily require a state-of-the-art counterfactual to prove causality. Instead, it has repeatedly held that there are different acceptable ways of proving such a link. ¹⁷¹ For example, it deems evidence that the price is excessive in relation to the economic value of the product sufficient. For this purpose, it accepts evidence that the difference between the cost actually incurred and the price actually charged is excessive and that the price is either unfair in itself or when compared with competing products. ¹⁷² This is hardly a precise scientific formula. Neither does it require the enforcement bodies to quantify what price that undertaking could have charged in a competitive market. Given that the Court has indicated that it is open to alternatives, it cannot be entirely excluded that the Court would accept a legal presumption of causality based on the fact that the dominant undertaking infringed an EU Regulation that itself contains a presumption of causality between the position of dominance and the detrimental effect. After all, the Court has not been averse to employing legal presumptions to infer certain effects on competition ¹⁷³ or the position of dominance itself ¹⁷⁴ in the past, even though the trend lately seems to have shifted in favor of more detailed individual assessments. ¹⁷⁵ However, one should not generalize. In the absence of precedent, it is impossible to predict with certainty whether the court would be willing to infer causality from the infringement of a regulation that condemns the conduct because the undertaking is dominant or whether it would require empirical evidence that the undertaking could not have dictated these detrimental conditions had the market been competitive.

In view of this uncertainty, and given the legal obligation to apply Article 102 TFEU in addition to national competition law if the conduct is also caught by Article 102 TFEU, the Düsseldorf court, or, at the very least, the German Federal Court on appeal, should make a reference for a preliminary ruling to clarify these questions of interpretation under Article 267 TFEU.