Open Rights Group (ORG) has already commented on the Interim version of this report, in particular by challenging CMA’s view that GDPR may have adverse consequences on competition. Here, we briefly cover the good, the bad and the ugly of CMA’s final report.
The CMA elaborates on the issue of data protection, and the way Google and Facebook are using it to impose unfair contractual terms to publishers. The good news is that CMA has accepted that large technology companies are deliberately using a double standard, being very permissive toward their own practices but very strict (and somewhat creative) in the limitations they impose to publishers and third parties.
Also, they accepted Brave’s view that implementing GDPR rules would be “‘inimical to internal data free-for-alls in vertically integrated platforms”. This is extremely relevant as Google or Facebook are merging personal data collected by different services and for different purposes, a behaviour which does not only grant them an unfair advantage against smaller competitors, but also violates purpose limitation rules under the GDPR.
Finally, the report strongly endorses the establishment of a Digital Markets Unit. This would entail both the CMA and the Information Commissioner’s Office, and would be regulating platforms with “strategic market status”. In turn, this new unit should be given the powers to
- increase consumers’ control over their data;
- mandate interoperability;
- mandate third-party access to data;
- mandate data separation.
Not everything turns out as it should, though, and the CMA report is no exception. We find two areas with shortcomings.
Firstly, the CMA analyses the role of social media companies in influencing publishers’ funding opportunities, concluding that the unfair share of revenues captured by adtech intermediaries (the “adtech tax”) ends up endangering the sustainability of journalism.
However, the CMA fails to consider how social media have a far greater role in influencing the standards of the contents which are shared online, for instance by tuning their algorithms so that they favour polarising content. This trend is particularly visible on Facebook, which opted not to enforce their community standards against some far-right agitators because of the high engagement of their articles.
In other words, the CMA fails to consider how publishers are being driven toward sensationalism and click-bait in order to meet the needs of the adtech industry — to gather as much personal information as possible in order to target viewers with as much advertising as possible.
Other than that, the CMA misfires on the issue of interoperability: although supporting a generic call to mandate interoperability to large technology companies, the CMA accepts the view that mandating content interoperability “would dampen incentives to invest and innovate, lead to excessive standardisation and risk foreclosing the market to innovative newcomers”. In doing so, the CMA risks precluding to newcomers the same opportunity that allowed most of nowadays Internet giants to enter the market in the first place.
The Facebook case is once again iconic: the early growth of their platform depended on their ability to interoperate with Myspace, which allowed users to subscribe to Facebook while being able to write to their own friends on Myspace. In recent years, however, Facebook waged war against online platforms which tried to do the same thing with them.
These two issues go hand in hand: by reducing the scope of interoperability, online platforms can reinforce their network effect and lock users to their products. This allows them to dictate standards and conditions to users and content creators, significantly affecting the way the Internet operates.
After producing over 400 pages of analyses, thoroughly explaining how the online advertisement industry is broken and subject to pervasive anticompetitive abuses, you would expect the market authority to intervene. This is, for instance, what the German antitrust authority did, when they asked Facebook to stop merging data from WhatsApp and Instagram users.
Instead, the CMA decided not to launch a formal market investigation, submitting that they would not have the powers to address the concerns the study highlighted. Thus, they will wait for the Digital Market Unit and an “appropriate legal framework” to be established before taking any action. As the Online Harms initiative has taught us, establishing the legal framework the CMA requires will undoubtedly take a long time; in turn, this will allow Google and Facebook to further solidify their position.
On top of that, the CMA also proposes to create a unique identifier for online users, to ease the portability of profiling data. In the CMA view, this should increase access to profiling data in favour of small adtech companies, and foster competition. However, the CMA’s thorough investigation ought to have highlighted how Google and Facebook have been gaining unfair market advantages by using data illegally — for instance, because they were collected without valid consent, or were repurposed in breach of GDPR rules.
Thus, the focus shouldn’t be placed on favouring the sharing of this data, but rather on enforcing the law. This would allow advertising models which are respecting users’ privacy to compete in a market which is not dominated by free riders.
The way forward
Despite the limitations we highlighted, the CMA market study represents a significant leap forward in the critique against online advertising. The huge amount of evidence and analysis concerning the market failure in the adtech sector speaks for itself: small advertisers are suffering unfair competition, publishers are unable to properly fund their own activities, and users’ privacy is being jeopardised.
All of this makes a compelling case for reforming the sector, which in ORG’s view should start with a strong enforcement of data protection laws. We all deserve an Internet where “our privacy is king” and where market operators are competing by the quality of their work, rather than the number of laws they infringe. Furthermore, online advertisement has proven to be more effective when it does not use personal data, making an outstanding case against tolerating the current state of affairs any further.