Reframing Antitrust Law for Big Tech: Lessons from the German Bundeskartellamt.

• Date: 01 January 2021
• Author: Weiss, Brennan

TABLE OF CONTENTS I. INTRODUCTION 195 II. FACEBOOK'S DATA POLICY 198 III. FACEBOOK IN GERMANY AND COMPETING MODELS OF ANTITRUST LAW 199 A. German Antitrust Law and the Facebook Case 199 1. German Legal Framework 200 2. The FCO'S Application of German Antitrust Law to Facebook 201 B. U.S. Antitrust Law: Illegal Monopolization Under the Sherman Act 204 C. Criticisms of Antitrust as a Mechanism to Address Privacy Harms IV. FACEBOOK IN THE UNITED STATES: APPLYING THE GERMAN DECISION UNDER U.S. LAW 207 A. The FCO 's Legal Theory Fails Under the Sherman Act 207 B. A Revised Theory of Anticompetitive Harm Under Sherman Act Section 2 209 1. The Government Could Make a Prima Facie Case of Facebook's Monopoly Power 209 2. The Government Could Make a Prima Facie Case of Anticompetitive Effects 210 3. Facebook's Likely Procompetitive Justifications Fail 213 C. Why the Critics Are Wrong: Antitrust Should Be Used to Address Privacy Harms 214 V. CONCLUSION 216 I. INTRODUCTION

Just weeks after news broke of one of the largest data leaks in the history of Facebook--resulting in a third party's use of millions of users' data without their permission--Mark Zuckerberg appeared before Congress in an attempt to mitigate the fallout. (1) But for two days, Zuckerberg played defense as members of Congress berated his leadership and, in particular, the social network's data privacy practices. At one point, Sen. Lindsay Graham (R-SC) zeroed in on Facebook's Terms of Service.

"When you sign up for Facebook, you sign up for Terms of Service ... It says, 'The Terms govern your use of Facebook and the products, features, apps, services, technologies, and software we offer (the Facebook Products or Products), except where we expressly state that separate terms (and not these) apply.' I'm a lawyer [and] I have no idea what that means. But when you look at the Terms of Service, this is what you get." (2) Sen. Graham then held up a thick stack of papers fastened by an extra-large binder clip. "Do you think the average consumer understands what they're signing up for?" Zuckerberg replied: "I don't think that the average person likely reads that whole document." (3)

In another exchange, Rep. Kathy Castor (D-FL) shed light on the breadth of Facebook's data collection practices as reflected in its Data Policy, which is part of the Terms of Service. She addressed Zuckerberg specifically: "We understand the Facebook users that proactively sign in are part of that platform, but you're following Facebook users even after they log off... You are collecting data outside of Facebook. When someone goes to a website and it has the Facebook 'Like' or 'Share' [button], that data is being collected by Facebook, correct?" (4) Zuckerberg's affirmative response was a convenient lead into Rep. Castro's proposal. "Congress should act," she urged. (5) "I do not believe that [Facebook's] controls, the opaque consent agreement, [and] the settings are an adequate substitute for fundamental privacy protections for consumers." (6)

Congress berated Zuckerberg. Yet, in the more than two years since Zuckerberg's testimony, Facebook's Data Policy remains virtually unchanged. (7) It is also unclear whether the average consumer has any better understanding of how Facebook's data collection works, despite the hearings and prolific news stories that followed. Put simply: Congress has failed to rein in Facebook's expansive data collection practices. (8)

Germany has a different approach to regulating Facebook. On February 6, 2019, Germany's Bundeskartellamt, or Federal Cartel Office (FCO)--the country's top antitrust enforcement authority--held that Facebook abused its market dominance by collecting user data not only on its platforms, but also on third-party websites and applications that have integrated Facebook Business Tools (such as the "Like" or "Share" functions) into their services. (9) The FCO ordered the social network to discontinue this practice. (10)

The FCO'S novel legal argument against Facebook's Data Policy--based on an antitrust theory of illegal monopolization--is an especially appealing approach in jurisdictions without comprehensive federal data privacy protections like the United States. This is because it is likely that jurisdictions with data protection laws, if they are at all structured like Europe's General Data Protection Regulation (GDPR), would use the force of such laws to crack down on expansive data collection practices. (11) However, in the United States, lack of a holistic federal data privacy law (12) makes it difficult for individuals to guard against take-it-or-leave-it data collection practices--to which the user must submit unless he withdraws from the service altogether--by powerful "data-opolies" like Facebook, Apple, Google, and Amazon. (13) Therefore, those in the U.S. seeking to challenge data collection practices by large technology companies must look to other areas of existing law that could serve as a basis for bringing suit.

This Note will argue that U.S. antitrust authorities, including the FTC and the Department of Justice (DOJ) Antitrust Division, should follow Germany's lead and aggressively pursue challenges against take-it-or-leave-it data collection practices by dominant technology companies like Facebook (14) based on an illegal monopolization theory of harm under Section 2 of the Sherman Act. Under Section 2, Facebook's Data Policy is anticompetitive because it impedes market entry by firms with potentially superior products and disincentivizes Facebook to innovate beyond what is necessary to maintain its existing users, thereby reducing the overall quality of its products and services. Part II will provide background on Facebook's Data Policy and describe the various sources from which Facebook collects data. Part III will highlight the antitrust legal framework in Germany, explain how the FCO applied that framework to Facebook, and then summarize relevant aspects of U.S. antitrust law. This section will also raise common criticisms of the use of antitrust law as a means to address privacy harms. Part IV will analyze the facts of the German case against Facebook in the context of U.S. antitrust law. This section will argue that the FCO's legal theory, albeit insufficient under Sherman Act Section 2, provides a framework upon which the FTC or DOJ could build by emphasizing how Facebook's Data Policy harms consumers by impeding market entry and reducing innovation and overall product quality. Such an illegal monopolization theory of harm would be successful under the burden-shifting framework established in Microsoft v. United States. This section will conclude with a policy discussion of the common criticisms addressed in Part III and argue that antitrust law should be used not as a placeholder for direct data privacy regulation, but rather as a means of challenging anticompetitive conduct that results in privacy harms.

2. FACEBOOK'S DATA POLICY

   Facebook collects "the content, communications and other information you provide when you use our Products, including when you sign up for an account, create or share content, and message or communicate with others." (15) This seemingly innocuous statement obscures the true scope of its data collection. Facebook divides its data sources into three categories: (1) things users and others do and provide; (2) device information; and (3) information from partners. (16)

   The first category--things users and others do and provide--is the most intuitive. It includes information gleaned from user activity on the mobile and desktop versions of Facebook (e.g. user interactions with other Facebook pages, accounts, and groups) and its "products," such as Messenger and Instagram. (17) The second category--device information--includes data from computers, phones, and other web-connected devices that consumers use when they are on Facebook. (18) It also includes information about the consumer's operating system, nearby Wi-Fi access points, device settings, IP addresses, and cookie data. (19)

   The third category of data--information from partners--is the most controversial because it enables Facebook to collect information about consumers from sources outside its platform, including advertisers, app developers, and publishers (referred to as Facebook "partners") who use Facebook Business Tools. (20) Such tools include Application Programming Interfaces (APIS), Software Development Kits (SDKS), Facebook code, and the "Like" and "Share" social plugins. (21) For example, if a third party, completely unrelated to Facebook, embeds Facebook's "Like" function into its website, and you access that website, Facebook has the ability to collect information about "your device, websites you visit, purchases you make, the ads you see, and how you use their services--whether or not you have a Facebook account or are logged into Facebook." This means that Facebook's data collection extends far beyond what users provide on the platform and likely beyond what most users might reasonably expect or to which they might knowingly consent.

3. FACEBOOK IN GERMANY AND COMPETING MODELS OF ANTITRUST LAW

   Discussion of potential antitrust implications of Facebook's data collection practices in the U.S. requires a baseline understanding of the current antitrust legal landscape. This section will describe German antitrust law's prohibition on dominance and abusive conduct. It also will explain that in finding against Facebook, the FCO relied primarily on evidence that Facebook's conduct resulted in anticompetitive effects that harmed Facebook's competitors. This section will then transition to discussing U.S. antitrust law and highlight provisions relevant to a potential claim against Facebook under the Sherman Act. And finally, this section will raise common criticisms of the use of antitrust law as a means to address privacy harms, which this Note will rebut at the end of its analysis.

   1. German Antitrust Law and...