Tag Archives: Regulators
Facebook’s massively lucrative advertising model relies on tracking its one billion users—as well as the billions on WhatsApp and Instagram—across the web and smartphone apps, collecting data on which sites and apps they visit, where they shop, what they like, and combining all that information into comprehensive user profiles. Facebook has maintained that collecting all this data allows the company to serve ads that are more relevant to users’ interests. Privacy advocates have argued that the company isn’t transparent enough about what data it has and what it does with it. As a result, most people don’t understand the massive trade-off they are making with their information when they sign up for the “free” site.
On Thursday, Germany’s Federal Cartel Office, the country’s antitrust regulator, ruled that Facebook was exploiting consumers by requiring them to agree to this kind of data collection in order to have an account, and has prohibited the practice going forward.
“Facebook will no longer be allowed to force its users to agree to the practically unrestricted collection and assigning of non-Facebook data to their Facebook user accounts,” FCO president Andreas Mundt said in a statement announcing the decision.
“We disagree with their conclusions and intend to appeal so that people in Germany continue to benefit fully from all our services,” Facebook wrote in a blog post responding to the ruling. The company has one month to appeal. If it fails, Facebook would have to change how it processes data internally for German users, and could only combine the data into a single profile for a Facebook account with that user’s explicit consent.
“This is significant,” says Lina Khan, an antitrust expert affiliated with Columbia Law School and the think tank Open Markets. She notes that authorities haven’t done a good job of articulating why privacy is an antitrust issue. Here, the German regulator makes it clear. “The FCO’s theory is that Facebook’s dominance is what allows it to impose on users contractual terms that require them to allow Facebook to track them all over,” Khan says. “When there is a lack of competition, users accepting terms of service are often not truly consenting. The consent is a fiction.”
According to the FCO, Facebook had 32 million monthly active users in Germany at the end of last year, amounting to a market share of more than 80 percent. The regulator argues this dominance gives it jurisdiction to oversee the company’s data collection practices.
“As a dominant company Facebook is subject to special obligations under competition law. In the operation of its business model the company must take into account that Facebook users practically cannot switch to other social networks,” said Mundt. “The only choice the user has is either to accept the comprehensive combination of data or to refrain from using the social network. In such a difficult situation the user’s choice cannot be referred to as voluntary consent.”
The FCO further argues that Facebook used its vast data collection to build up its market dominance, creating a feedback loop wherein people have no choice but to use the site and allow it to track them, which makes the site even more dominant and entrenches its privacy violations.
“The Bundeskartellamt [FCO] underestimates the fierce competition we face in Germany, misinterprets our compliance with GDPR and undermines the mechanisms European law provides for ensuring consistent data protection standards across the EU,” Facebook wrote in response to the ruling. They cite Snapchat, Twitter, and YouTube as direct competitors, hoping to illustrate that there isn’t lack of competition, and therefore the FCO has no standing to apply rules based on Facebook’s dominance. “Popularity,” they write, “is not dominance.”
The FCO disagreed, explaining that Snapchat, YouTube, and Twitter serve totally different functions from Facebook, and therefore can’t be seen as viable alternatives to the service.
Antitrust regulators used to consider data and privacy outside their purview. The old philosophy held that antitrust was concerned with price, and if a product was free then consumers couldn’t be harmed, says Maurice Stucke, antitrust expert and law professor at the University of Tennessee. “What we’re seeing now is those myths are being largely discredited.”
The most remarkable part of the ruling is the way it makes clear that privacy and competition are inextricably intertwined. “On the one hand there is a service provided to users free of charge. On the other hand, the attractiveness and value of the advertising spaces increase with the amount and detail of user data,” Mundt said. “It is therefore precisely in the area of data collection and data use where Facebook, as a dominant company, must comply with the rules and laws applicable in Germany and Europe.”
“This is the first instance where [regulators] are saying that because [a company has] such market power that consent is not freely given,” says Stucke.
The FCO ruling explains that the harm to users from Facebook’s data collection is not in cost but in “loss of control.” “They are no longer able to control how their personal data are used. They cannot perceive which data from which sources are combined for which purposes with data from Facebook accounts and used e.g. for creating user profiles,” the FAQ on the ruling reads. That combining of data gives it a “significance the user cannot foresee.”
That fact is underscored by people’s ignorance of Facebook data practices. Roughly 74 percent of American Facebook users surveyed recently by the Pew Charitable Trusts did not know that Facebook maintained profiles about their interests. Fifty-one percent of those surveyed said they weren’t comfortable with the practice.
But Facebook says that tracking people makes the services safer and better, and that the FCO misses how much the company has done in order to comply with the General Data Protection regulation passed by the European Union in 2018.
The FCO’s ruling, however, directly addresses the GDPR, writing that under its principles Facebook has “no effective justification for collecting data from other company-owned services and Facebook Business Tools or for assigning these data to the Facebook user accounts.” (Facebook Business Tools are the Like and Share buttons that appear all over the internet, and which allow Facebook to track you on sites they don’t own.) In other words, in addition to being anticompetitive in its view, the FCO believes Facebook hasn’t proven that data collection and bundling is in the best interest of every consumer and that its sites couldn’t function without it.
If Facebook loses the appeal, then Germany will become a grand experiment in whether the surveillance economy is actually essential to the operation of social media. Other Europeans and Americans may demand they are given the same option. “This ruling is really an icebreaker. Icebreakers break through the ice in order to lead the path for other vessels to follow,” says Stucke.
More Great WIRED Stories
The United Kingdom’s Information Commissioner’s Office issued an order Friday requiring SCL Elections, the British affiliate of the controversial data mining firm Cambridge Analytica, to turn over all of the data it collected about a United States-based academic named David Carroll. Carroll filed a request for this data in January of 2017 under British data protection law, and received a response in March of that year that the Information Commissioner Elizabeth Denham describes in the order as “wholly inadequate.” Now, Denham is requiring SCL to comply with the request, or face criminal charges.
The enforcement order comes just days after Cambridge Analytica, which worked for Donald Trump’s 2016 campaign, announced that it would shut down and declare bankruptcy, along with its international affiliates, following revelations that the companies had harvested the data of up to 87 million Americans without their knowledge. The company’s former CEO Alexander Nix was also recorded this year on undercover video, appearing to brag about using tactics like bribery and entrapment on behalf of Cambridge Analytica’s clients.
Long before the name Cambridge Analytica became notorious in households across the country, though, Carroll, a professor of media design at Parsons School of Design in Manhattan, became suspicious about the way the company built its so-called psychographic profiles of US voters. These profiles, the company claimed, contained information not only about people’s demographics, but their personalities as well. Given that Cambridge Analytica originally spun out of a British company called SCL Group, Carroll filed a request under the UK’s Data Protection Act seeking access to all of the information the company had collected on him.
When SCL sent Carroll back his file, he was utterly unsatisfied. It ranked his interest in topics like immigration and gun control on a numeric scale, but offered no insight into what data was being used to generate those scores, or who actually used them. In mid-March, the same day Facebook announced it was suspending Cambridge Analytica and SCL Group from its platform as punishment for their transgressions, Carroll filed a request for disclosure in the UK in an attempt to force SCL to hand over the underlying data and answer a litany of questions about how they were being used.
Though that case is still ongoing, the ICO’s order does accomplish some of that work for Carroll. In the order, Denham describes the months-long battle between her office and SCL’s office over Carroll’s data request. According to the order, SCL repeatedly argued that as an US citizen, Carroll had no right to request his data under British laws, going so far as to write in one response that Carroll had no more data access rights in the UK “than a member of the Taliban sitting in a cave in the remotest corner of Afghanistan.”
Denham disagreed with that assessment. In March, after the undercover videos of Nix went public, the ICO stormed the company’s offices and seized its servers. Now, the regulator is giving SCL 30 days to provide descriptions of Carroll’s personal data, the purpose that data served, a list of all the recipients of that data, copies of the data itself, and the sources of that data.
“It’s quite exciting,” Carroll says of the order. “At the minimum, it’s the beginning of a victory and pointing toward winning.”
Still, he says, “It didn’t have to come to this. We’ve been trying for more than a year to do this out of court…It just kept escalating.”
SCL now has the opportunity to appeal the ICO’s order. Representatives for SCL didn’t immediately respond to WIRED’s request for comment.