Following preliminary objections over Google’s data terms, set out back in January by Germany’s antitrust watchdog, the tech giant has agreed to make changes that will give users a better choice over its use of their information, the country’s Federal Cartel Office (FCO) said today.
The commitments cover situations where Google would like to combine personal data from one Google service with personal data from other Google or non-Google sources or cross-use these data in Google services that are provided separately, per the authority.
“In the future Google will have to provide its users with the possibility to give free, specific, informed and unambiguous consent to the processing of their data across services. For this purpose Google has to offer corresponding choice options for the combination of data,” the FCO said, adding that the design of the new “selection dialogues” must not seek to manipulative users towards cross-service data processing (aka, no dark patterns).
We’ve reached out to Google for comment on the development and to ask when (and where, i.e. beyond Germany) it intends to rollout the new choice interfaces. At a minimum, it is likely Google will offer the same revised choices across the European Union in light of similar competition rules.
Update: Per the FCO decision document: “The Commitments cover in principle all services operated by Google and directed to end users in Germany with more than one million monthly active users (MAU) in Germany [and Android Automotive whether it meets that threshold or not].” But, as we report below, Google’s core platform services designated under the EU’s DMA are not covered — nor is Fitbit, which the document notes is already subject to “far-reaching obligations regarding the cross-service processing of health and wellness data” as a result of EU merger control.
The FCO announcement essentially signals an enforced unpicking of Google’s privacy-hostile decision, back in January 2012, to consolidate multiple privacy policies for its products (more than 60 separate privacy notices) into a single, overarching policy.
At the time the adtech giant claimed this enforced collapsing of multiple privacy policies and combining of user info across its products would lead to “a simpler, more intuitive Google experience”. But of course the move enabled it to pool vast amounts more personal data — dialling up its ability to profile web users and supercharging its ad-targeting business at the expense of competitors that lacked its scale in web services.
The FCO, or Bundeskartellamt, has been investigating Google’s data terms since May 2021 — announcing then that it would look at whether Google/Alphabet “makes the use of services conditional on the users agreeing to the processing of their data without giving them sufficient choice as to whether, how and for what purpose such data are processed”.
The issue of concern for the competition regulator is how Google collects and connects user data across multiple services it owns and operates — and whether it gives users sufficient choice over its profiling of them for ad targeting. Its particular interest in Google’s T&Cs is the risk that a lack of choice for consumers over the company’s processing of their information could negatively affect competition by giving Google a strategic advantage over competitors that don’t have the same wide-ranging ability, derived from its products’ market dominance, to combine data on users and build highly detailed, commercially valuable files of their interests.
In January the FCO’s preliminary verdict on Google’s data terms was users were “not given sufficient choice as to whether and to what extent they agree to this far-reaching processing of their data across services” — with the options Google did provide found to be insufficiently transparent and “too general”.
It also said then that sufficient choice would require Google’s users to be able to limit its processing of their information to the specific service being used; and be able to differentiate between the purposes for which the data are being processed. Choices must also not be manipulated using deceptive design (so called dark patterns) — with the regulator stipulating Google must ensure it’s as easy for users not to consent to the processing as to consent.
Today’s announcement indicates the FCO is satisfied the examined practices by Google are anti-competitive under relevant German law.
Commenting in a statement, Andreas Mundt, president of the Bundeskartellamt, said:
Data are key for many business models used by large digital companies. The market power of large digital companies is based on the collection, processing and combination of data. Google’s competitors do not have these data and are thus faced with serious competitive disadvantages. In the future users of Google services will have a much better choice as to what happens to their data, how Google can use them and whether their data may be used across services. This not only protects the users’ right to determine the use of their data but also curbs Google’s data-driven market power. Large digital companies offer a wide range of different digital services. Without the users’ free and informed consent the data from Google’s services and third-party services can no longer be cross-used in separate services offered by Google or even be combined. We have made sure that Google will provide a separate choice option in the future.
Last year the FCO’s probe of Google stepped up a gear after the authority confirmed that rebooted domestic competition rules which target tech giants can be applied to Google — finding the company is “of paramount significance for competition across markets” as the law in question (the GWB, or German Act Against Restraints of Competition) terms it.
This law empowers the German watchdog to act more proactively to curb competition risks in light of the market power of designated digital giants. (Others with the designation include Amazon, Apple and Meta.)
A similar ex ante competition regime recently started operating in the EU, aka the Digital Markets Act (DMA). So it’s interesting to see the Bundeskartellamt pressing on with an intervention against Google — given equivalent restrictions against combining user data without consent are baked into that pan-EU regime.
Google was designated a DMA gatekeeper last month — when the EU listed Google Maps, Google Play, Google Shopping, Google Ads Services, Google Chrome, Google Android, Google Search and YouTube as so called “core platform services”, meaning they are all subject to restrictions imposed by the regulation. Albeit there’s a six month deadline for gatekeepers to come into compliance with the DMA — which means major operational changes by the likes of Google likely won’t kick in until March 2024.
In its press release, the Bundeskartellamt notes that it’s been working with EU competition regulators in light of their designation of Google as a DMA gatekeeper. It says this is also why the commitments Google is making to the FCO will only apply to products that aren’t covered by the DMA designations (so not the aforementioned eight Google products).
Google’s commitments to the FCO will cover more than 25 other Google services — including Gmail, Google News, Assistant, Contacts and Google TV, per the FCO.
“The proceeding is a testament to the close cooperation between the Bundeskartellamt and the European Commission on the way to achieving more competition and fair markets in the digital sector,” it said in a press release.
“By cooperating closely, the Bundeskartellamt and the European Commission also intend to give Google the possibility to proceed in a uniform manner,” the FCO added. “The requirements for sufficient choice to be offered pursuant to Google’s Commitments essentially equal those under the DMA. The Bundeskartellamt also exchanged information with the German data protection authorities.”
In further public remarks, Mundt also pointed out: “The platform regulation pursuant to the Digital Markets Act by far does not cover all services offered by the companies which have been designated as gatekeepers, and it does not cover all competition issues either. For this reason it remains important to resolutely apply competition rules in parallel to the enforcement of the DMA.”
Germany, which is a member of the European Union, has a data protection framework derived from the bloc’s General Data Protection Regulation (GDPR) which also sets controls on how people’s information can be processed — requiring a valid legal basis to perform these kind of data operations.
One such basis is to obtain user consent but if consent is the basis claimed the GDPR regulates the quality of the consent — requiring it is informed, specific and freely given. So data terms which don’t give user a proper choice over what happens to their information risk being found in breach of EU privacy rules too.
The next obvious question, flowing from the FCO’s announcement of Google’s commitments, is what will “free, specific, informed and unambiguous consent” look like in this context?
We asked the authority about this but a spokesperson declined to comment on “any eventual possible solutions”. “Next step is now for Google to present an implementation plan within the next three months,” they added.
A separate proceeding the FCO has brought against Meta may offer some clues, though: Back in June, on the back of another Bundeskartellamt probe, the authority announced Meta would be launching a new account center that would provide users with a greater degree of choice over whether they allow it to combine data on their activity across its services or not.
Although there was a trade-off — users who denied Meta’s cross-profiling would be denied the ability to cross-post to other Meta services (i.e. they’d be penalized with a degree of reduced functionality); ergo, on the flip side, users who wanted the ability to cross-post would have to agree to Meta combining their data for ad targeting…
The FCO dubbed this outcome as a “largely free” choice.
In a separate regulatory scenario (under the GDPR) also currently unfolding in the region, Meta has been found to lack a valid legal basis for processing its users’ data for ads. Recently it indicated it would switch to seeking EU users’ consent for ads processing. However press reports this week suggest Meta plans to roll out a subscription product in order to offer users a binary choice between paying it for an ad-free version of its services or accepting its tracking and profiling.
It’s interesting to consider how the FCO might respond were Google to suggest tweaking its own data terms to a ‘pay us or okay our processing’ choice.
It’s also interesting to note the concession the FCO extracted from Meta this summer, in relation to users’ ability to influence its cross-site tracking of them, did not entail users having to pay Meta if they want to block its cross-service tracking.
Per the FCO decision document, the implementation date (in principle) for Google’s commitments is September 30, 2024 — with an earlier date of March 6, 2024 for commitments covering Google Assistant and Contacts. But the FCO notes that it may provide Google with an extension upon “substantiated request”. Once implemented, the commitments will have a five year duration from their start date.
The document also notes that if, in the future, a Google service falls out of the DMA designation as a core platform service and meets the FCO usage threshold then these local commitments will be applied to it. The converse will also apply; meaning if the European Commission designates one of the Google services covered by this commitments to the DMA list of core platform services it would no longer fall under this arrangement.
Gmail is an interesting example here as the EU recently accepted Google’s arguments to exclude the web mail service from the DMA list of core platform services — but the tech giant is facing future restrictions on how it can use Gmail users’ data under the FCO commitments (even if these will only apply in Germany).
This report was updated with detail from the FCO decision document, including the scope of services covered by the commitments, implementation dates and duration