Data Exploiting as an abuse of dominance: The German Facebook decision

On February 6th, the Bundeskartellamt (German Federal Cartel Office - "FCO") ruled that Facebook abused its dominance by improperly combining user data that it collected. The FCO imposed far-reaching restrictions on Facebook’s processing of user data in the future, including a requirement that Facebook must obtain "voluntary consent" from consumers before using such data.[1] Some celebrate the decision as an innovative enforcement approach to protect consumers. Others wonder if the ruling over-stretches the limits of competition law. This article outlines the background to the FCO’s investigation, its key findings, and possible enforcement lessons to be learned from the decision, both in the EU and U.S.

Relevant Conduct

Users that wish to join Facebook need to accept its terms and conditions. Amongst others, these conditions allow Facebook to collect data about its users. This also includes the collection of data when they are not on the Facebook website. In particular, Facebook also collects data through Facebook-owned services such as WhatsApp and Instagram, as well as through third-party websites that have embedded Facebook business tools (for "like" or "share" buttons) or Facebook analytical services (Facebook Analytics). When a user engages with these services, data is transmitted to Facebook and combined with the other data in the user's Facebook account. Many users may not be aware of this.

Background: Facebook's history of data protection infringements

The FCO launched its Facebook investigation in March 2016. Before that, there had been an outcry in Germany that Facebook de facto ignored a ruling of an appeal court to bring its terms and conditions in line with data protection laws.[2] Several data protection authorities and consumer rights groups had challenged Facebook's terms and conditions. None of the challenges ultimately had much success. Furthermore, at that point, the sanctions provided by data protection law and general civil law apparently did not sufficiently motivate Facebook to adjust its terms and conditions. As a result, there was immense political pressure pushing the FCO to use its strong(er) arsenal of sanctions under competition law against Facebook. The result was the February 6th decision.

The FCO's February 6th decision

The FCO ruled in its decision that the extent to which Facebook collects and merges user data constitutes an abuse of a dominant position under Section 19 of the German Competition Act ("GWB").

Facebook was found to have a dominant position in the German market for social networks. The FCO considers Facebook to be an intermediary on a multi-sided network market. While Facebook is financed through targeted advertising, for the purpose of determining dominance, the FCO focused on the private users as the relevant market. This market excludes professional social networks such as LinkedIn, and services such as Snapchat, YouTube and Twitter, because they only offer parts of the services of a private social network. With a market share of more than 80%, various positive network effects, and additional network-specific barriers to entry, Facebook was found to be dominant in the relevant market.

According to the FCO, Facebook's use and implementation of its data-related terms and conditions infringes Germany's data protection laws, and constitutes an abuse of dominance "in the form of exploitative business terms pursuant to the general clause of Section 19(1) GWB."[3] Taking into account the assessment under data protection law, these terms were found to be inappropriate because they exploited Facebook users. The FCO based this assessment on two decisions of the German Federal Court of Justice.[4] These decisions established that not only excessive prices, but also inappropriate contractual terms and conditions, may constitute an exploitative abuse. The Court of Justice further ruled that general clauses under civil law (one of which is Section 19 GWB) should be applied to outbalance bargaining powers in cases where one contractual party is so powerful that it can dictate the terms of the contract, and the other party lacks any contractual autonomy.

According to the FCO, Facebook's terms and conditions did not cause any financial damage to users. Instead, the damage was determined to be the users' "loss of control." Users could not freely determine and oversee how their personal data is used from the various Facebook data sources.

General assessment

Over the last five years, the FCO has actively built up specific know-how with respect to digital markets. In several working papers the FCO tried to catch up with the particularities of multi-sided online markets.[5] Some fruits of this approach have become apparent in the FCO's convincing delineation of the relevant market, and its assessment of Facebook's dominance. When considering the various economic factors that render Facebook a dominant platform, the FCO is at its best. In this respect, the February 6th decision provides some guidance for other authorities that deal with Facebook.

The FCO can also be praised for considering the relevance of data for competition on platform markets, in particular those financed by targeted advertising. Advertising is the lifeblood of the internet. Yet the various levels of the digital advertising value chain are highly concentrated. It can therefore be expected that there will be more competition investigations dealing with the collection, use, and sharing of data that is essential for this entire industry.

However, in establishing an abuse of Facebook's dominant position, the FCO's reasoning in its new decision does not appear to be entirely convincing. Possibly due to the political pressure resulting from data protection and consumer rights groups, the FCO has tried to establish an exploitative practice to the direct detriment of consumers. Yet, for several reasons discussed further below, there was no indication in the decision that consumers were "forced" to accept any clauses that genuinely exploit them, let alone that competition law is the right tool to create more transparency.

It would have been more convincing if the FCO had focused on Facebook's hindering of competitors on the online advertising markets. The FCO mentioned in passing that the exploitative conduct would also "impede competitors that are not able to amass such a treasure trove of data."[6] The FCO also explained that besides private users and advertisers, publishers and app developers are two other user groups of Facebook's platform. Both integrate the investigated Facebook products such as social plugins (e.g. "Like" button), Facebook Login, and the Facebook Analytics analysis service. And both user groups compete with Facebook on data-driven online advertising markets. Hence, instead of focusing on Facebook's relationship with private users, the FCO might have identified more genuine competition concerns by analyzing the negative effects of Facebook's conduct on publishers, app developers, and potential competitors. As the FCO rightly pointed out, "[t]oday data are a decisive factor in competition."[7]  

Exploitation or win-win-situation?

The FCO assumed in its February 6th decision that Facebook's collection, combination, and use of data exploits private users because it exceeds what is necessary for Facebook to operate its platform. However, in assessing the adequacy of this data use, the relevant question should be whether users get something adequate in return. In this respect, the FCO does not appear to have considered the benefits of the collected data for Facebook's targeted advertising, or the benefit of this advertising, in turn, for private users. In economic terms, the FCO undervalued the positive indirect network effects between the advertising side and the private user side of Facebook's platform.

Facebook is offered to private users for free. The entire platform is financed by advertisements. From traditional media we know that users generally do not like advertising unless it is relevant for the user at the point in time the advertisement is displayed. Someone planning a first skiing trip may appreciate an ad for snow tires at that time, but not an ad for swimming suits. In order to generate the value of advertisement for consumers (= lower search and transaction costs), a platform needs to know what the user is currently or at least generally interested in. Facebook's collection and combination of data through external services is aimed exactly at that. Such targeting is a common standard today and is, in principle, in the interest of both the consumer and the advertiser. The more relevant an ad is for a user, the more likely it will convert into a transaction, and the more an advertiser is willing to pay. Better converting ads thus allow the platform to display less ads to finance and expand the platform (without having to charge the user). Considered from this standpoint, it is far from apparent that Facebook's conduct "exploited" private users. It may well be that their gain in product quality (less and more relevant ads) outbalances their loss of full control over their data.

Link between dominance and abuse?

It should go without saying that an infringement of data protection law (or any other law) should not automatically infringe competition law, simply because it is committed by a dominant company. Competition law loses its own contours and legitimacy if it is misused to (just) fill in enforcement loopholes in other laws such as weaker sanctions. There needs to be a link to competition and, more specifically, a connection between the dominant company's market power and the condemned conduct.

The FCO has tried to establish such a link by contending that by virtue of its dominance Facebook "forced its users to agree to the practically unrestricted collection and assigning of non-Facebook data to their Facebook user account. Yet, the FCO stressed that "the users are not aware"[8] of the scope of Facebook's collection and combination of data from external sources. Thus, users either had no knowledge of Facebook's underlying terms and conditions or they misinterpreted them. But if that is so, these conditions would not have played any role for the users' decision to join the platform and to stay on it. On this basis, the FCO's view that users were "forced" to accept Facebook's data collection somewhat collapses. Someone who does not know anything about a particular business condition or practice cannot approve it, let alone be forced to accept it.

If anything, the data collection shows an asymmetry of information between Facebook and its users. However, the lack of knowledge or understanding of business terms is not limited to dominant companies. Even in markets with intensive competition, companies of any size and type infringe data protection rules. Conversely, if faced with an information asymmetry, even companies with superior bargaining power may sign unfavorable contracts the scope of which they do not fully grasp. It is thus not apparent that Facebook's excessive use of data is indeed "a manifestation of Facebook's market power"[9] as contended by the FCO.

To be sure, for the link between dominance and abuse, the European Courts have not required that there is a strict causality in the sense that the company must have used its power to realize its conduct. It suffices that the conduct strengthens its dominant position.[10] However, this rule was developed for exclusionary practices where the link between abuse and dominance is apparent. For exploitive practices, where no impact on the market may be required, it should not suffice that the conduct strengthens the market position of the dominant company. That is because virtually every breach of any law provides the infringer with a competitive advantage. Yet, not every breach of law is also a manifestation of market power.

Guidance for EU competition law

In theory, the FCO's case could also have been brought under Article 102 TFEU para. 2, which prohibits exploitative practices. Yet, despite having consulted other European authorities, and unlike most of its other abuse of dominance cases, the FCO did not (also) rely on Article 102. It contended that only in Germany the courts would rule that for the purpose of assessing the abusiveness of a conduct, authorities may also take basic constitutional rights and the valuations of other legislation (here: data protection law) into consideration. Thus, the FCO did not appear to consider its decision as a precedent for other jurisdictions.

EU Commissioner Margarethe Vestager has already said that the FCO decision will be studied with "great interest" but that she did not believe "it can serve as a template."[11] Neither is it likely that the FCO's reasoning will be adopted and lead to a flood of similar investigations by other European competition authorities.

In that regard, in May 2018 the EU General Data Protection Regulation ("GDPR")[12] came into force. A new ePrivacy Regulation (ePR)[13] is expected to take effect in 2019. Both regulations provide much more powerful sanctions than previous legislation to ensure data protection and privacy. This (hopefully) will dissolve some of the motives that triggered the FCO investigation.

Moreover, if it was not for the two German court decisions relied upon by the FCO, the reasoning of the FCO appears rather shaky. For a dominant company to impose unfair trading conditions, its trading party must get disproportionately less in return to what that party is providing, and this disbalance must be linked to the market power of the company imposing the conditions. Both aspects are questionable here.

Guidance for U.S. Antitrust Law Enforcement

As the FCO considers the conduct as a type of abusive exploitation, it provides no guidance for enforcement under U.S. law. Under Section 2 of the Sherman Act, "even a monopolist is free to exploit any market power."[14] For the same reasons, a monopolist would appear to be free to collect and combine more data from its customers than is required to sustain its service.

Nevertheless, the FCO's finding of dominance may be of assistance to a U.S. enforcement agency in a case against Facebook claiming exclusionary conduct. The same may be true with respect to the FCO's assessment of the relevance of data for the affected markets. The ruling also may have significance in connection with the enforcement of consumer protection laws in the U.S.

Guidance for German competition law

The FCO decision may broaden the scope to scrutinize business terms under German competition law. Ultimately, with the reasoning applied by the FCO, the business practices of several dominant companies could be challenged. This, for sure, provides an additional incentive to take the (rapid) implementation of the GDPR in Germany very seriously.

Facebook has now appealed the FCO's decision, perhaps with a good chance of success. Consequently, the FCO may therefore prefer to await the outcome of this appeal before it "jumps" on other companies with the same underlying rationale. It would probably be welcomed by many, if in the meantime, it focused on genuine competition cases.

This article was published as part of Hausfeld's Winter Competition Bulletin and in Lexology in February 2019.

[1] FCO, case B6-22/16, see press release of 7 February 2019, Bundeskartellamt prohibits Facebook from combining user data from different sources, available at

[2] Berlin Appeal Court, 24 January 2014, Case 5 U 42/12.

[3] FCO, Case B6-22/16, Case Summary, Facebook, Exploitative business terms pursuant to Section 19(1) GWB for inadequate data processing, available at

[4] German Federal Supreme Court, 6 November 2013, case KZR 58/11, BGHZ 199,1 - VBL-Gegenwart; 7 June 2016, case KZR 6/15, BGHZ 210, 292 - Pechstein.

[5] See for instance: FCO, June 2016, Working Paper On Market Power of Platforms and Networks,; FCO/Autorité de la concurrence, May 2016, Competition Law and Data, May 2016,;

[6] FCO, n. 1.

[7] Andreas Mundt in FCO, press release n. 1.

[8] FCO, n. 1.

[9] FCO n. 3.

[10] ECJ, 21 February 1973, Case 6/72, para. 27 – Continental Can; ECJ, 6 February 2012, Case C-457/10 P, para. 168 – AstraZeneca.

[11] Bloomberg, 8 February 2019, Germany’s Facebook Order Will Be Studied by EU, Vestager Says,

[12] Regulation (EU) 2016/679 of 27 April 2017, OJ EU L 119/1,

[13] See Proposal for a Regulation concerning the respect for private life and the protection of personal data in electronic communications, COM/2017/010 final,

[14] Verizon Communication Inc. v. Law Offices of Curtis V. Trinko, LLP, 540 U.S. 398 (2004).

*Prof. Dr. Thomas Höppner is a Partner in Berlin.

Other Publications