The EU takes the lead in regulating Big Tech

Just a handful of massive companies, with wealth greater than some countries, controls almost every aspect of the internet. They can decide which voices to amplify or silence, which businesses to boost or crush (or acquire), and what personal data they will collect and monetize, all with almost no accountability or oversight.

This centralization of power into the hands of a few multinational corporations runs counter to the original dream of a free, open, and fair internet. And as the events of recent years have shown, they are a threat to democracy.

In December 2020, the European Commission released its proposal for the Digital Markets Act (DMA), the EU’s attempt to curtail Big Tech’s power and revive competition on the internet. Like the flurry of American antitrust investigations, the DMA is a sign that politicians finally have recognized how much Big Tech has abused its ever-growing power over the past decade.

The world is finally waking up to the threat Big Tech poses to an open internet and democracy. In December, the EU provided preliminary details on the Digital Markets Act (DMA), its most sweeping effort yet to prevent anti-competitive behavior. The DMA is a proposed set of rules that would require tech monopolies to play fair. We believe the DMA will be critical to the future of the internet. In a blog article, we analyze why it could set an important precedent for lawmakers in other countries.

The Details in the long read:
Who does the DMA apply to?

The DMA is a set of rules that target “gatekeeper platforms,” which are massive tech companies that control “core platform services” of the internet that link a business and its customers. A gatekeeper can control more than one core platform service, and many of them do. The DMA contains a list of what are considered core platform services, which includes search engines, social networking services, certain messaging services, and operating systems. The European Commission can also add services to that list as necessary.

In many cases, these core platform services function as a bottleneck, forcing all companies to use the same tool to reach the vast majority of their market. Controlling these bottlenecks gives companies immense power to effectively cut off a company from the segment of the market they control. Think of how Apple controls which apps it allows on its mobile devices or how Google controls which companies will be the first search result. This control coupled with Big Tech’s global scale has given these companies unprecedented power.

To ensure that it does not hinder companies that are still developing, the DMA’s rules would only apply to gatekeeper platforms that have met all of the following criteria for the past three years:

Achieve either an average market capitalization of at least €65 billion — or have an annual turnover of at least €6.5 billion in the European Economic Area (EEA)
Have at least 45 million monthly active end users within the EU
Have at least 10,000 yearly active business users within the EU

(It is slightly more complicated than this, but these are the important standards to know.)

The DMA only targets the truly massive corporations. This way, companies and potential competitors to the Big Tech monopolists are not burdened with undue regulation.
What does the DMA do?

The DMA rules would impose a number of obligations on gatekeepers. These obligations are intended to prevent them from abusing their power and engaging in anti-competitive behavior. They do not address free speech on the internet or how to govern it (that is covered in the EU’s proposed Digital Services Act). Think of the DMA as essentially a list of “Dos” and “Don’ts” for Big Tech. Some of the most important obligations are listed below:

Article 5(a) — Don’t mix personal data without a user’s explicit consent
This would prevent gatekeepers from combining personal data collected from their core platform services with personal data collected from other services or from a data broker without explicit consent. It would also prevent them from forcing you to automatically sign in to all of a gatekeeper’s services if you only want to sign in to one.
Example: Google would not be able combine the data it has collected from you with commercially available data, like your credit score. You would also be able to sign in to Gmail without signing in to all of Google’s services.
Article 5(c) — Do allow business users to promote offers to end users
In effect, gatekeepers would be required to allow businesses to inform their customers about alternative purchase options.
Example: Apple would have to let app developers inform their users of cheaper subscription offers that are available via their website in the App Store.
Article 5(e) — Don’t force business users to adopt the platform’s authentication system.
Businesses could still choose to use the gatekeeper’s ID system, but it would not be required.
Example: An app developer would be allowed to create their own ID system for their app and Google would not be able to force them to use its ID system.
Article 5(f) — Don’t cross-tie core products.
Gatekeepers would not be able to force users to sign up for one of its core services as a precondition to getting access to another of its services or products. Gatekeepers’ products and services would be available to users separately.
Example: Users would be able to access the Android operating system without a Gmail account.
Article 6(a) — Don’t spy on business users to gain an unfair competitive advantage.
Currently, gatekeepers can use private data from their platform and monitor their business users’ data to determine how to place, price, and advertise competing goods or services. The DMA would ban this practice.
Example: Amazon would no longer be able to use its search results data to determine what goods to clone and start selling itself.
Article 6(b) — Do allow users to uninstall any pre-installed software applications
Gatekeepers would have to allow their users to uninstall any pre-installed software applications that are not essential to running the hardware.
Example: You would be able to delete the pre-installed calendar or calculator apps on your smartphone.
Article 6(c) — Do allow third-party app stores and users to side-load apps.
Under the DMA, gatekeepers would only be allowed to prevent third-party app stores if they damage or undermine the “integrity of the hardware or operating system.”
Gatekeepers would not be able to prevent users from accessing services they acquired outside their platform.
Example: Apple would not be able to block users from downloading apps that are not in the App Store.
Article 6(d) — Don’t give preference to platforms’ own products in rankings.
Gatekeepers would not be able to unfairly rank their own products and services more favorably than their competitors.
Article 6(e) — Don’t lock users in.
Gatekeepers would not be able to technically restrict users from deleting apps or switching away from default apps. They also cannot force users to use a particular internet service provider.
Article 6(f) — Do make platforms interoperable with other service providers.
Gatekeepers would have to make their platforms open to some key third-party service providers, like payment providers, digital identity providers, or ad-tech sellers, on the same terms as their own services.
Article 6(h) — Do make data portable and continuously accessible in real time.
Gatekeepers would have to give all users the ability to download their data and take it to a rival. They must also make both end and business user data continuously accessible in real time to their competitors.
Article 6(i) — Do give businesses access to their own data.
Gatekeepers would have to give business users real-time, continuous access to high-quality data from the gatekeepers’ platform about their sales, customers, and other commercial activity.
Article 6(k) — Do provide fair and nondiscriminatory access to app stores.
The DMA states that gatekeepers that manage app stores would have to accept apps onto their platform in a fair and nondiscriminatory manner.

What happens if a company violates a DMA obligation?

The DMA currently states that the European Commission alone will be responsible for enforcement, meaning they would investigate any alleged violations and hand out penalties to any gatekeepers that violate the DMA’s new rules.

The authors of the DMA seem to understand the size of the companies they are trying to rein in. In fact, these companies are so large, they regularly set aside billions of dollars just to pay regulatory fines. In light of this, gatekeepers that violate the DMA would face:

Fines of up to 10% of the company’s total worldwide annual turnover
Example: Facebook’s global revenue for 2019 was $71 billion. It could, therefore, be subject to a $7.1 billion fine.
Periodic penalty payments of up to 5% of the average daily turnover for ongoing infractions

And if a company repeatedly or systematically violates its DMA obligations as a gatekeeper, the Commission could impose additional penalties, including potential “structural remedies” (e.g., being forced to sell parts of the business).
The DMA could change the internet

As an organization dedicated to defending fundamental human rights and democracy, Big Tech’s accumulation of power has been an ongoing concern. Before we can create an internet that puts people first, we need to end the monopolies’ domination. The DMA targets many of the most egregious abuses over the past decade, especially in the mobile device sector.

If the DMA’s obligations are enforced quickly and vigorously, they have the potential to change the very business model many of the gatekeepers rely upon. Several of the DMA’s obligations, such as the prohibition on mixing gatekeeper data and commercially available data, would make it harder for companies like Google and Facebook to monetize users’ personal data.

And if these companies continuously violate the DMA, the Commission could force Google to divest from YouTube (or Facebook from Instagram).

The DMA’s success or failure will come down to how the current draft’s principles are fleshed out into actual provisions that can be implemented and how the Commission decides to pursue enforcement. Big Tech has been cementing its position for years, so it is important that the EU gets the DMA correct from the beginning. Every delay gives tech monopolists more time to further entrench their advantages.

One cause for concern is the amount of manpower the European Commission is calling for. According to recent documents, the task group that will lead DMA enforcement is to be composed of 80 individuals, which seems woefully inadequate given their task’s scope and complexity. Further, the Commission suggests creating this team only after the DMA is enacted, meaning they could be stuck playing catch up.

The GDPR is a pertinent example. The GDPR has been successful in giving users a greater window into which companies have access to their data. The DMA is also taking inspiration from the GDPR in that it is legislation that aspires to be global in its impact. Unfortunately, the current DMA proposal did not learn from the GDPR’s mistake of not having national data protection agencies fully staffed when the GDPR was implemented. This staffing lag meant that it took over a year before any major penalties for GDPR infractions were handed out.

Advocating for a strong DMA

We are now entering a critical phase of the DMA. Big Tech is going to try to exert all its influence to water down the DMA obligations and their enforcement, precisely because it would expose them to true competition. European citizens and independent tech companies must prevent these lobbying efforts from succeeding.

If you live in Europe and want an internet that respects your security, privacy, and freedom, contact your MEP and tell them you support a strong DMA that is actively enforced.

The DMA represents the best chance society has had in years to check Big Tech’s power and break up the monopolists.

Author Richie Koch - protonmail

Riveting pollution

Absolutely agree with the need. Finding a solution to such a complex problem is inherently fraught with difficulty and compromised solutions but based on a very quick read it doesn't look too bad for what it is intended to do. However, as they say the devil is in the detail and in such cases also in the application