Social media platforms and content exposure: How to restore users’ control

Data collection and profiling

Profiling has become common practice for online platforms and has evolved to an extent not imaginable just a few years ago. It implies the use of personal data to segment people according to precise profiles. Major social media platforms use dozens of thousand indicators to classify people’s interests and personal attributes; in addition, automated profiling is capable of identifying patterns that are invisible to the human eye.

Profiling needs data harvesting: the more platforms know about users, the more they can profile them. It follows that the first step for this model to work is to gather as many users’ personal data as possible and definitely more than it would be necessary to offer the social media service.

This approach is problematic, or more precisely illegal, for at least two reasons. First, it infringes the principles of necessity and proportionality, which should be used to measure the fairness of ToS under Article 102 TFEU. The EU Courts and the European Commission have provided, already long ago, an interpretation of the concept of ‘fairness’ of trading conditions by reference to the minimum balance that must exist between the rights, interests and obligations of the contracting parties that have agreed to trade under those conditions. A condition going beyond what is ‘absolutely necessary’ for the achievement of the one party’s objective has been considered as an ‘unfair’ limitation of the freedom of the other party, and thus abusive if enacted by a dominant player. From this perspective, the test of ‘fairness’ of trading conditions is essentially a test of ‘indispensability’ or ‘proportionality’ of those conditions. ⁸

Second, it infringes the principle of data minimization provided by the General Data Protection Regulation ⁹ (GDPR, 2016), which seeks ensure that organizations are only collecting the minimum amount of personal data required to fulfil a purpose. The GDPR establishes three relevant criteria for the compliance with this principle: data that are collected shall be adequate, relevant and limited to what it is necessary for the purpose. Nevertheless, social media platforms often collect data that are not directly relevant nor necessary for the offering of the social media service.

Furthermore, studies have demonstrated that majority of users are not aware they are subject to profiling nor are they happy about it. In 2018, 74% of US users weren’t aware that Facebook assembled lists of their interests and traits and 58% declared they were ‘not comfortable’ with the company compiling that information, which could include racial or ethnic ‘affinities’ and political leanings (Hitlin & Rainie, 2019).

Enforcers in different EU countries have started to deal with these concerns. For example, as it is described in more details later on, the Italian Competition Authority has recently assessed that Facebook’s ToS require consent to unnecessary personal data processing operations and that they impose on users, without express and prior consent, the transmission of their data to third-party websites or apps for commercial purposes (AGCM, 2018). A similar approach, this as well analysed more in depth in the following session, has been adopted by the German Competition Authority, which states that ‘by combining data from its own website, company-owned services and the analysis of third party websites, Facebook obtains very detailed profiles of its users and knows what they are doing online’. (Bundeskattellamt, 2019). It is worth noting that the legal instrument used in both cases is different: the Italian Authority applied provisions on unfair commercial practices, while the German based its intervention on competition rules and in particular on the provisions of abuse of dominance under German law.

Personalization through automated systems of content moderation

The more companies can profile users, the more they can personalize, via automated systems of content moderation, the service they offer to them, and this includes prices, advertising and content in general. Although the behind mechanism is similar, the impact of these different types of personalization on users’ rights might be substantially different.

Price personalization implies that the platform can use the data it has collected from the user to infer his/her willingness to pay. Here again, the more information a platform can collect from the user, the more accurate it will be its estimation of his/her willingness to pay. The impact of personalized pricing on individual users can vary. If his/her willingness to pay is high, the platform might decide to charge higher prices than the ones it would charge under uniform pricing. But if his/her willingness to pay is low, the platform might decide to charge lower prices than the ones it would charge in case of uniform pricing. Therefore, a user can be better off or worse off depending on his/her specific willingness to pay (Bourreau & De Streel, 2018).

The increased capacity of profiling users allows platforms to personalize also ad messages, which are tailored on the users’ preferences. This practice generates immediate economic gains for different actors: for the advertisers, because when target market aligns with the user demographics of a social platform, social advertising can provide huge increases in conversions and sales with comparatively lower cost of acquisition; and for the platforms, because they usually charge advertisers based on impressions served and/or on users’ action (AGCOM, 2018; Edwards, 2018).

The personalization extends to general content, being it articles, posts, pictures or anything that can be shared and access on social media.

The combination of big data and algorithmically controlled exposure to content leads to users being exposed only to a specific type of content: the one platforms believe they will engage the most because it matches the users’ profile as created by the platform itself based on the massive amount of personal data collected from users. ¹⁰

Among others, this mechanism tends to lock users into the so-called filter bubbles or echo chambers, where they encounter only information and ideas that they view favourably or agree with. Some have argued that it is also at the basis of many disinformation strategies, which can be implemented for commercial but also for political and ideological reasons.

This article focuses on the targeting and personalization of content at the level of the individual. Nevertheless, it is worth recalling that these behaviours raise problems also at community level. The violation of freedom of expression of the individual user can become a threat to democracy at societal level, as it makes possible to influence, or event to manipulate the public discourse, and to shape social views, political opinions and norms. In this regard, scale augment the danger: the percentage of population potentially subject to social media platforms’ influence is more than relevant. In addition, the fact that these platforms are a handful raises additional high concerns in terms of media plurality and media freedom, which currently do not appear to be guaranteed online as they are offline.

Social media companies typically present the personalization of content as a mechanism to improve the service offered to users, a feature that enhances their experience. To describe it, they use terms such as moderating, managing, ranking, discouraging or promoting content.

However, the practice has a strong negative impact on users’ freedom of expression and information (Yeung, 2018). This right implies people shall have access to plurality and variety of information and content, because this is the way they can form their own opinions and actively participate to societal debate. To guarantee that citizens are exposed to free, diverse and pluralistic media has traditionally been a fundamental public objective for democratic States. Considering that social media platforms nowadays constitute one of the main channels’ citizens access information, one can argue that the continuous interference in the content users are exposed to violate their freedom of expression and information.

Additionally, a number of characteristics of this kind of interference raise additional high worries. First, it is hidden, in fact, digital technologies allow social media platforms to perform data collection, profiling and personalization in a way that is barely visible to users. But it is there, and widespread, for as these platforms mediate so much of so many users’ lives that the potential reach of the interference is limitless. Second, it is targeted and therefore suited to better exploit cognitive, emotional and other user’s vulnerabilities.

All this summed up, one can argue that the interference caused by social media platforms takes the form of manipulative practices (CoE Committee of Ministers, 2019; Susser, Roessler, & Nissenbaun, 2018). In fact, it alters users’ choice architecture, which can be defined as the context in which users make decisions, in turn shaped by the way users’ options are selected, arranged and presented. The choice architecture, therefore, naturally impacts the way users’ understand options and respond to them. When this architecture is altered by platforms behaviours users are not aware of, manipulation of the latter decision-making process occurs. It has to be noted that for manipulation to realize, it is not necessary to prove that in the counterfactual, that is, the absence of the manipulative practice, the target would have decided differently. In fact, manipulation is the interference in the decision-making process, irrespective of the outcome.

Relevant rules and conducts concerned

Consumer protection rules usually regulate B2C relationships and aim to ensure that the latter remain fair notwithstanding the different bargaining powers held by professional traders, on the one side, and consumers, on the other side. Among others, these rules typically impose obligation with regard to transparency, fairness of clauses and consent.

EU consumer law is bulky. ¹⁴ For the purpose of this analysis, the legislative instruments of major interest are three: the Unfair Commercial Terms Directive, ¹⁵ the Unfair Commercial Practice Directive ¹⁶ and the Consumer Rights Directive. ¹⁷ None of these instruments contains a one size fits all regulatory solution for the theory of harm addressed in this article; in addition, as directives need to be implemented by member States, national rules remain quite relevant and not always sufficiently harmonized.

Consumer rules address platforms’ ToS and more in general any aspect of the relations between platforms and users with regard to the provision of the service.

Possible remedies

Consumer protection rules could be used to oblige social media platforms to duly inform users that the content they are exposed to has been artificially promoted and/or given prominent display and explain why and how. In other words, when platforms perform personalization by automated systems for content moderation, they should empower users to understand how the content is organized, filtered and displayed and which criteria and which personal data have been used to do it. This would imply to also adequately inform users about, among others, the data that the platform collects about them, how and for what purpose it processes it, whether and under which conditions it resells data to third parties.

Currently though there is a spread claim that social media platforms do not sufficiently satisfy information requirements and as mentioned, enforcers have started to intervene. For example, the Italian Competition Authority has recently sanctioned Facebook for unfair commercial practices arguing, among others, that the information the platforms provide to its users about the use of their data is general and incomplete and does not adequately make a distinction between the use of data to personalize the service (to connect users with each other) and the use of data to carry out advertising campaigns aimed at specific targets. The Italian Authority also found that Facebook exerts undue influence on registered users, who suffer, without express and prior consent and therefore unconsciously and automatically, the transmission of their data from Facebook to third-party websites/apps for commercial purposes, and vice versa. The undue influence is caused, argues the authority, by the preselection by Facebook of the broadest consent to data sharing (AGCM, 2018) ¹⁸ .

The Italian Competition Authority stresses several times that the unfair collection and use of users’ data is done for profiling and commercial exploitation purposes. Therefore, it explicitly recognizes the link between the elements of the complex typology analysed by this article, that is, data collection, profiling and personalization, which causes the harm to content exposure.

Interestingly, the authority also clarifies the relationship between consumer protection rules and data protection ones, justifying its intervention under the former. According to the authority, there is no conflict between the two set of rules, which complement each other. ¹⁹ If on the one hand Facebook remains subject to data protection rules, on the other hand the case at stake deals with the impact that the company’s conducts have on the commercial decisions of consumers and not on their right to privacy or data protection (AGCM, 2018). Thus, the focus of attention appears to be on the effects of the conducts on users’ choice architecture.

Likely strengths and limits

These enforcement actions could contribute to set higher standards in the market and stimulate platforms to compete on the quality of ToS with regard to transparency and data protection. In fact, consumer rules apply horizontally to all players, irrespective of size and market power. Possibly, enforcers and decision makers could also create a black list of commercial terms, to be regularly updated and impose platforms to provide users with a clear summary of key ToS (BEUC, 2017).

Another advantage of consumer rules is that they provide mechanisms for collective redress in mass harm situations. This feature is all the more useful in the social media context due to the fact that users are millions, if not billions, and they all asked to agree to the same ToS, profiled and subject to the same content moderation mechanisms (BEUC, 2018).

Nevertheless, improving transparency without providing users with effective choice does not solve the problem. Certainly, the first step is to make users aware of the features of the service they use and understand and freely agree to the commercial terms existing between themselves and the providers. But the second, inevitable, step is to provide them with a choice in case they are not willing to consent to what they receive information about. Finally, transparency might place a substantive burden on users who have to seek information about the business conducts they are subject to, interpret them and assess the impact they have on their rights, and only to find that they have limited, if any, power to change anything.

Furthermore, the current EU consumer protection rules reveal a number of shortfalls when applied in social media markets, which the EC proposal for modernization (European Commission, 2018b) is partly attempting to fix (EDPS, 2018; European Parliament Research Service, 2018). For example, the Consumer Rights Directive only refers to contracts under which the consumer pays a price, and it is therefore not applicable where users provide their personal data in exchange for the service. It is unclear if information requirements contained in this Directive therefore currently apply to social media platforms.

Consumer legislation contains further inconsistencies with regard to ‘free’ digital services. The Consumer Rights Directive applies to contracts for the supply of both paid and ‘free’ digital content (e.g. apps, games and videos), but it only applies to paid digital services (e.g. cloud storage, webmail, social media), while ‘free’ digital services, which are usually paid by personal data, are excluded. If the proposed Digital Content Directive is adopted in its current version, it will contain remedies in contracts for both paid and free digital services and for both paid and free digital content, therefore possibly creating further inconsistencies. To avoid conflict and guarantee legal certainty, further clarity should be provided for businesses and consumers.

Moreover, under the Unfair Commercial Practice Directive, price is one of the most important elements to test if a commercial practice is unfair. But users pay the social media service with their data, and while the economic value of the latter is undisputed, if data are considered a counter-performance, then the concept of price is not applicable.

Neither the Unfair Commercial Terms Directive grants adequate attention to data. In particular, it does not include contract terms on the processing of data or the performance of data among those that can cause significant imbalance between the provider’s and the user’s rights and obligations.

All the above considered, the extent to which consumer protection rules will be able to address the harm at stake depends on the future evolution of the norms, as well as on the capacity of consumer protection authorities to address behaviours such as profiling and personalization. In this scenario, consumer associations across the EU might have an important role to play in raising awareness and providing relevant data and information about relevant conducts.

Link to other solutions

As noted, the application of consumer protection rules does not imply that companies are exempted from respecting other rules such as, among others, data protection (Helberger, Zuiderveen Borgesius, & Reyna, 2017; Jerker & Svantesson, 2018) and, if they are in a dominant position, competition norms on abuse.

In addition, enforcement initiatives have so far targeted only part of the complex typology that, as explained, causes the harm in terms of content exposure. In fact, actions have focused on opacity and unfairness concerning data collection and data usage but not (yet) on the lack of transparency concerning the automated systems of content moderation. In other words, as noted by distinguished voices, the algorithms, which constitute the backbone of the platforms’ business model, remain a mystery for users (BEUC, 2018). Therefore, the scope of the intervention could be enlarged, including an assessment of the unfair conducts impact on freedom of expression and information. To this aim, enforcers of consumer rules could refer to the existing body of human rights rules as a normative parameter in their analysis and coordinate with enforcers traditionally called to apply them. Finally, consumer protection authorities could work together with other relevant regulators to ensure that measures enhancing user autonomy are implemented as well as part as part of the enforcement action.

Relevant rules and conducts concerned

Competition rules exist to protect consumer welfare and competitive process. They aim to guarantee that markets remain open to new entrants and that players compete fairly to the consumers’ benefit.

Competition law does not condemn dominance per se but attributes a special responsibility to dominant players: because of their position of market power, they cannot take certain actions, which would not be a concern from smaller players.

For example, Article 102 TFEU prohibits dominant players from exploiting consumers, among others through the imposition of unfair commercial clauses. When a social media platform holds a dominant position on the market, therefore Article 102 TFEU applies to its ToS.

Competition rules do not deal only with market power but also with market concentration, prohibiting practices that increase it in a way that significantly lessen competitive dynamics. As social media platforms operate in highly concentrated markets, they are subject to these rules too, in particular insofar as they put in place conducts that make more difficult, for competitors, to enter the market or strategically acquire them to avoid competition.

Competition rules potentially apply to any elements of the business model of social media platforms, therefore also to those that harm consumer right to freedom of expression.

Possible remedies

As mentioned, in the EU, the normative concept of ‘fairness’ of commercial conditions is tested against the minimum balance that must exist between the rights, interests and obligations of the contracting parties that have agreed to trade under those conditions (Kalimo & Majcher, 2017). In the previous part of this article, it has been argued that ToS regulating data harvesting, profiling, personalization and content moderation disproportionately restrict users’ freedom of expression and data protection rights and that such restrictions do not appear necessary for the provision of the service, nor proportionate. Therefore, they constitute unfair commercial terms under Article 102 TFEU.

Moreover, a sufficient guarantee of users’ privacy and free of expression is a parameter of the service’s quality, which a dominant player should not be allowed to lower disproportionately only by virtue of its position of market power. It follows that enforcers could apply Article 102 TFEU to sanction the quality degradation that dominant platforms impose on their users. ²⁰ If the degradation concerns specifically data protection, enforcers could use the GDPR as normative frameworks against which assess this degradation; if the latter concerns free expression, enforcers could be guided by the international framework that protects that right.

In both cases, dominant social media platforms’ behaviour causes the exploitation of users and should be sanctioned. Competition enforcers could impose pecuniary penalties to infringers, together with a cease and desist order for the illegal behaviour, and behavioural of structural remedies, which shall be proportioned to the infringement committed and necessary to bring it effectively to an end.

There is another, although indirect, way in which competition rules can be used to protect users’ right to decide what content to be exposed to.

In fact, competition law also protects choice. For choice to be available on the market, the competitive process has to be protected and the market has to remain open to new entrants.

It can be argued that dominant social media companies act as gatekeepers: economic gatekeepers, because they manage to lock in users and maintain competitors out of the market, and ‘fundamental rights’ gatekeepers, because with their behaviours, they set the standards for the protection, or better said the violation, of users’ free expression and data protection in that market.

Enforcers could use competition rules to prohibit incumbents from putting in practice illegal behaviours to exclude competitors or to impede newcomers from accessing the market. If sufficient competitive process is restored in social media markets, one can assume that the main competitive drivers for platforms will be the quality of the service they offer, and not price, as the service is usually offered for free. If this happens, users who want their data to be protected, or who want to have control of the content they see and access to on social media, should be able to find real alternative on the market.

Competition authorities could also ensure that users can easily switch from a provider to another. In fact, because social media platforms are usually ever more attractive the more people use it, users will have real choice only if efficient competitors are able to enter the market and gain critical mass and only if measures such as data portability and multi-homing are effectively in place.

Finally, competition enforcers could play a role in preventing further concentration in the market, for example, by stopping social media platforms to further grow by acquiring other players in the same or adjacent markets.

Likely strengths and limits

Competition rules could be used not only to provide short-term remedies for the harm delineated in this article but also long-term ones. More specifically, competition law could be used to trigger the competitive process in the social media markets on parameters such as quality and choice, which will contribute to the creation of a healthier, and more human rights friendly environment for users.

Furthermore, competition law could be used to target the entire complex typology of conducts addressed in this article. In fact, competition norms typically look at combination of conducts and at business models in their entirety.

In addition, as mentioned, while sanctioning conducts under Article 102 TFEU, competition authorities can impose structural or behavioural remedies. Thus, they could impose on social media platforms the use of specific ToS or limits to data collection or data processing that go even further what provided by the GDPR. However, this way of acting runs the risk of resulting too invasive for the economic freedoms of the platforms and too oriented towards ex ante regulation rather than ex post intervention.

Link to other solutions

Competition enforcers could easily use the GDPR and the human rights framework as normative parameters for the assessment of relevant conducts and ask relevant authorities for opinions, technical analysis or similar forms of support and cooperation.

In addition, competition intervention, coming ex post, does not undermine the possibility, for other regulators, to apply complementary norms to reinforce the protection of users’ free expression from illegal violation perpetuated by social media platforms. As long as these actions are coordinated, they will mutually exploit synergies and tackle the entire set of relevant conducts.

Relevant rules and conduct covered

In the available regulatory toolbox, one could also include the international legal framework for the protection of these human rights, which is composed by international and regional norms, such as relevant international treaties, conventions, the EU Charter of fundamental rights, ²¹ national constitutional norms but also soft law instruments such as recommendations, opinions and declarations.

The international body of norms concerning human rights is particularly rich. Although these rules are usually addressed to States, the requirement that private actors shall respect fundamental rights is not a new call. The Guiding Principles on Business and Human Rights ²² provide a starting point to shape companies’ responsibilities in this regard. Among others, the Guiding Principles recommend companies to (i) make public statement on their commitments to respect human rights; (ii) conduct due diligence and impact assessments to identify, prevent and mitigate against any potential negative human rights impacts of their activities; (iii) incorporate human rights safeguards by design to mitigate adverse impact; and (iv) make remedies available where adverse human rights impacts are created.

In his 2013 Report (OAS Special Rapporteur on Foe, 2013), the Special Rapporteur for Freedom of Expression of the Inter-American Commission of Human Rights recommended, among others, that private companies establish and implement service conditions that are transparent, clear, accessible and consistent with international human rights standards and principle. More in particular, the report notes that companies have to ensure that any restrictions based on their ToS do not unlawfully or disproportionately restrict free expression. ²³ Similar principles are recalled in the 2016 Report on Standards for a Free, Open and Inclusive Internet.

More recently, the Special Rapporteur on Freedom of Expression, in its 2018 Report on AI and its impact on freedom of expression and information, has recommended, inter alia, that companies should make explicit where and how artificial intelligence technologies and automated techniques are used on their platforms, services and applications (Special Rapporteur on FoE, 2018). Furthermore, the Special Rapporteur has recalled that people have the right to individual autonomy, which implies that ‘artificial intelligence must not invisibly supplant, manipulate or interfere with the ability of individuals to form and hold their opinions or access and express ideas in the information environment’. For the Special Rapporteur, respecting individual autonomy means,

at the very least, ensuring that users have knowledge, choice and control. Pervasive and hidden artificial intelligence applications that obscure the processes of content display, personalization, moderation and profiling and targeting undermine the ability of individuals to exercise the rights to freedom of opinion, expression and privacy. ²⁴

Although the EU Charter does not apply to undertakings, but to member States and EU institutions when acting within the scope of EU law, it is hereby argued that the provisions of Articles 8 and 11 of the Charter could indirectly target social media platforms, obliging them to guarantee the fundamental rights of their users. Article 8 and Article 11 establish, respectively, the right to protection of personal data and the right to freedom of expression and information. Both these rights are also enshrined in the constitutional traditions of the EU member States. Therefore, States have positive obligations to put in place measures that guarantee them.

Possible remedies

The enforcement of the human rights framework usually concerns the single individual and the single case and focuses on compensating the harm that has been caused to the claimant.

Users could claim the reimbursement of the damage suffered and the restitutio in integrum. Possibly, and depending on the procedural rules in place in the country where they have their residence or bring the action, they could also ask for injunctions.

In parallel, the international human rights framework should guide States in their legislative and policymaking activities. States are not only called to respect citizens’ human rights in their actions but also to set the frameworks and conditions for private actors to do so.

Likely strengths and limits

In terms of enforcement, the application of the EU Charter often implies a balancing exercise between fundamental rights and economic freedoms. Traditionally, courts are better placed to perform this assessment. Possible shortfalls of recurring to courts are first, that users bear the burden of proof, in a context characterized by enormous information asymmetries. Second, that class actions might be difficult to run, therefore it might take long time before companies decide to change their behaviours, and thus before the social dimension of the problem, rather than the individual one, is solved.

On the contrary, if enforcers are called to perform the assessment, safeguards could be established to avoid an a priori hierarchization of rights. This is all the more needed, and all the more problematic, if companies themselves perform the assessment via self-regulatory measures.

Link with other solutions

As mentioned, rather than being a self-standing solution to the harm at stake in this article, the human rights framework could be better used as a normative parameter to assess social media platforms’ behaviours. This could be performed ex post, by regulators in enforcement actions or by users in damage claims; or ex ante, in the form of impact assessment operated by platforms themselves while shaping their business models and by legislators while issuing new rules concerning the activities of social media platforms.

Relevant rules and conducts covered

The GDPR applies directly to undertakings, as long as they process data of data subjects who are in the Union. ²⁶ Articles 5, 6 and 7 establish the principles relating to the processing of personal data, the condition for the lawfulness of processing, as well as the conditions for consent. The ambitious objective this regulation wants to achieve is to protect all EU citizens from privacy and data breaches in today’s data-driven world.

Social media platforms are one of the biggest data controllers and data processors of our time. Therefore, there is no doubt that their ToS, and more generally their behaviours with regard to data collection and data processing, need to comply with the GDPR.

Possible remedies

The GDPR establishes that consent of the data subject means

any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. ²⁷

Furthermore, the provisions on data minimization could be used to limit the disproportionate collection of data by social media platforms. In fact, Article 5 of the GDPR mandates that personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. In addition, Article 25 of the GDPR requires organizations to incorporate data minimization into the total lifecycle of their products, services and processes.

Moreover, DPAs could use the right to data portability as established in Article 20 GDPR to oblige social media platforms to make switching easier for users. To a certain extent, to be effective, this right needs to be complemented with adequate measures aimed to ensure transparency and interoperability, which could, in turn, have a positive impact on the competitive structure of the market.

Other GDPR provisions could be used to protect users from social media platforms abuses. For example, the regulation limits the use of automated decision-making in certain circumstances and requires individuals to be provided with information as to the existence of automated decision-making, the logic involved and the significance and envisaged consequences on the individual. ³⁰ Furthermore, the GDPR prohibits (with narrow exceptions) decisions that are made solely on automated processing, when they have legal or other significant effect on the individual. ³¹ Finally, and more in general, the GDPR introduces a range of provisions aimed at supporting the design of less privacy intrusive AI systems (Privacy International and ARTICLE 19, 2018).

This powerful regulatory instrument has been already used by a number of DPAs in the EU to condemn behaviours of online platforms. Interventions focused on the protection of users’ right to know what personal data companies have gathered about them, where they got it and with whom these companies have shared it. For example, the Swedish privacy watchdog accused Google of non-compliance with the GDPR with regard to its collection of location history from mobile devices (Datainspektionen, 2019). The French DPA imposed on the same company a financial penalty of 50 million Euros for violations of the GDPR rules for lack of transparency, inadequate information and lack of valid consent regarding ads personalization (CNIL, 2019). The Italian DPA has closed its investigation against Facebook concerning the Cambridge Analytica case and at the moment of writing is preparing to issue sanctions against the platform (Garante della Privacy, 2019).

Likely strengths and limits

With the entry into force of the GDPR, the role DPAs can play in the protection of users’ rights has increased. DPAs around the EU are developing new skills, expertise and capacity, and there are evident moves towards harmonized approaches in different member States.

Nevertheless, although data protection rules are an efficient instrument to condemn data protection breaches, they address only one element of the complex typology that causes harms to users, that is the way data harvesting and data processing are conducted. In other words, the GDPR enforcement by DPAs could be part of the solution, but to avoid the harm to content exposure more is needed.

Link with other solutions

Using data protection rules allows DPAs to proceed with targeted intervention, but in a number of cases these authorities have already declared their willingness to cooperate with competition and regulatory authorities where needed, to ensure that individuals’ personal data are duly protected in the relevant market.

For example, the Italian DPA has recently worked together with the Italian Competition Authority and the Italian regulator for telecoms and media on a study about big data (AGCOM, AGCM, Garante della Privacy, 2017). This kind of cooperation should take place not only with regards to market studies but also in enforcement actions where a comprehensive assessment and response to complex digital behaviours is needed.

Further steps have already been taken in this direction. By way of example, the European Data Protection Supervisor has clearly expressed its support to regulators’ cooperation across sectors, which include competition authorities, consumer protection ones and DPAs (EDPS, 2018).

In addition, there appears to be consensus on the fact that privacy is a parameter of competition and that therefore DPAs should work closer with NCAs to ensure that the decisions and measures adopted to protect privacy also go in the direction of restoring the competitive structure of the market. To reach this aim, various forms of coordination could be foreseen: for example, NCAs could be obliged to ask DPAs to provide specific expertise (in the form of an opinion or other non-binding instrument) in cases where the accused behaviours involve data collection or data processing.

Relevant rules and conducts covered

Broadcasting regulation was historically posited in part on the limited number of channels being available to audiences. The imposition of rules was justified by the existence of a bottleneck at the level of content production, which was considered a risk for media freedom, plurality and diversity, that are essential components of a democratic society.

Currently, an additional bottleneck might be identified at the level of distribution online. In fact, irrespective of the content produced and available, a handful of platforms intervene on how it is distributed, and thus on what users finally see or do not see. Being this the case, the rules by which intermediaries control discovery and distribution become a matter of legitimate public interest

It can then be argued that this additional bottleneck justifies the application, to social media platforms, of the specific obligations traditionally imposed on content producers, with due adjustments.

Furthermore, normative and policy discussions about media diversity and plurality might not be limited to the supply side but should also take into account the demand side. In other words, what matters is the content the user actually selects, not the content that is available; the diversity of exposure and consumption, not the diversity of supply (Helberger, 2012; Helberger, Karppinen, & D’Acunto, 2018; Karppinen, 2013; Nguyen, Hui, Harper, Terveen, & Konstan, 2014). The exposure to different content is valuable from an economic and societal perspective and should be then protected by regulatory intervention.

Possible remedies

A possible instrument to safeguard media plurality and diversity could be the imposition, on platforms, of rules aimed at avoiding concentration in social media markets, such as limits to social media or cross- (social) media ownership concentration, or special rules on quotas concerning selected type of content.

Transparency obligations about how algorithmic systems impact exposure diversity could as well contribute, although as argued already in previous parts of this article transparency is not a sufficient solution.

Likely strengths and limits

The imposition of limits to concentration could guarantee users the access to different social media platforms. This, in turn, could increase the variety of content they are exposed to, if not eliminating at least limiting the harm this article has identified. Furthermore, aiming to create a diverse and plural ecosystem, these rules could establish the conditions for the long-term guarantee of users’ freedom of expression and information.

Although the imposition of these rules would not imply the requalification of social media platforms as media companies, change which has been strongly resisted by these companies in the past years, it nevertheless would create risks of inconsistency with the existing regulatory framework, starting from the e-Commerce Directive. ³² In addition, although media freedom and media pluralism are values recognized and guaranteed by the EU Charter, ³³ their implementation is left to member States. Therefore, national rules could differ, creating disparity of conditions across the EU.

Link to other solutions

Here again, the application of rules borrowed from the traditional media regulatory framework will not compete, but rather complement the enforcement of other instruments, and specifically of competition rules. To this aim, a closer cooperation between media regulators and competition authorities should be guaranteed.