German cartel watchdog objects to the way Google processes user data

Not transparent, not specific, and too easy to say yes to

Google users don't have enough choice over whether – and to what extent – they agree to "far-reaching processing of their data across services," Germany's competition regulator says, adding that the tech giant should change its "data processing" terms and practices.

"The choices offered so far, if any, are, in particular, not sufficiently transparent and too general," the federal cartel office said this morning in its statement of objections.

It also noted the notorious propensity of users to click-click-click to make the boxes go away – and the engineering choices behind this, stating: "The choices offered must not be devised in a way that makes it easier for users to consent to the processing of data across services than not to consent to this."

They should also be allowed to "limit the processing of data to the specific service used" and "be able to differentiate between the purposes for which the data are processed," it said.

The competition regulator sent an initial letter to Google on December 23, the day before everything shuts down for German Christmas, but the statement of objections gives Google the opportunity to state its own case, and offer commitments or suggestions to allay the Bundeskartellamt's concerns. If it's not sufficiently persuasive, Germany will officially prohibit Google from continuing the practice. It's expected to make a decision by the end of 2023.

German law goes further than EU's Digital Markets Act. Why?

If this sounds pretty soon for a European competition decision, it's because it's just the German authority involved in this case. The cartel watchdog is making the move under Section 19a GWB, signed into German competition law in June last year, but it also notes that the European Digital Markets Act (aka the DMA, exclusively enforced by the European Commission) is also likely to apply to certain Google services in the future.

German residents are deeply opposed to sharing their personal data, for obvious historic reasons, and are suspicious of anything that looks like surveillance. There is strong support for laws that regulate this, which the country's politicos are well aware of, hence the relatively robust legislation in place.

Google Street View, for example, has blurred or blank spots across the streets of many German cities, and sometimes when you drag Peg Man into a street, there's nowhere for him to land. This is because the government insisted in 2010 that people be allowed to ask for their residences to be blurred or removed as a condition of letting Google operate Street View – and about a quarter of a million opted out. When it was later discovered that from 2008 until 2010 it not only took pictures of houses for Street View but also scanned wireless networks within range and stored the data (including Wi-Fi headers), the tech giant was fined by German regulators (and other authorities across the globe) against the backdrop of widespread outrage.

Google deleted the data it collected.

EU-wide complaint? It's coming....

The infamous section 19a and the DMA were developed concurrently, but as Germany notes, it "partially exceeds" the future requirements of the DMA. Both laws are expected to take the fight to the "internet giants" – namely Google, Amazon, Meta, Apple and Microsoft – as they collectively accumulate more and more of pretty much any and all internet users' data.

Those future requirements of the DMA, which came into play in November last year, include a provision that will also address data processing across services, but this will apply only when they involve "so-called core platform services" – which have yet to be designated by the European Commission.

The cartel office said of the move: "Google's business model relies heavily on the processing of user data. Due to its established access to relevant data gathered from a large number of different services, Google enjoys a strategic advantage over other companies. Google's practices must be measured against the requirements under the new competition rules for large digital companies. The company has to give users sufficient choice as to how their data are processed."

Google is just the latest of the big tech platforms to fall afoul of Section 19a GWB, the main function of which is to allow Germany's competition authority to intervene early in sectors where individual companies might have a "gatekeeper" function and thus prevent potential anti-competitive effects.

In the first six months after the law came into effect, the cartel office initiated proceedings against four of the five tech giants.

Watchdog not just growling

And the law has some teeth. The federal cartel office claimed a win under the same law in November last year after Meta unhooked the VR glasses formerly known as Oculus from a Facebook login. Meta made the move after the watchdog's May 2022 ruling, which said Meta wasn't allowed to make the use of Oculus conditional on the existence of a Facebook account and blocked sales of the devices in Germany. German VR fans can now buy and use them with a "Meta account" that won't link all their Facebook contacts and data to it.

Bundeskartellamt chief Andreas Mundt said at the time that the question of how that data would be processed in connection to Meta's other "various services" was still unresolved, and the cartel office wasn't going to close the book on the case until this was established.

Google sent us a statement: "People expect us to operate our business responsibly - by both maintaining product experiences that put users first and updating our services continuously to meet the expectations of regulators. We'll continue to engage constructively with the FCO to try and resolve their concerns." ®