Germany: the FCO is scrutinising data access

Data has a very significant and steadily growing role in competition law enforcement.^[1]

Germany’s Federal Cartel Office (FCO) was one of the first competition authorities to focus on the importance of data. In early 2016, it opened proceedings against Meta (then Facebook), alleging that Meta has superior access to competitively relevant data (in particular the personal data of its users) and considered this to be an important factor in its assessment of the alleged market power of Meta as a social network. Following a settlement between the FCO and Meta in October 2024, this saga has come to an end (see further, below).

Alongside the FCO’s investigations, the German legislative landscape has also evolved to reflect the growing importance of data:

• Following the 2017 revision of the German Act against Restraints of Competition (German Competition Act (ARC)), access to ‘competitively relevant data’ is an explicit criterion for assessing market power.^[2] It was also clarified that – even if provided free of charge – a service can be considered to fall within a relevant market for competition law purposes.^[3] This is particularly important for digital businesses where it is often argued that the customer ‘pays’ with data.
• The 2021 revision of the ARC brought in significant changes for digital businesses in general and data-driven businesses in particular:
  • The FCO’s New Competition Tool was introduced,^[4] equipping the FCO with additional enforcement power in respect of ‘companies of paramount significance for competition across markets’. Data is an important criterion in assessing whether a company is classified as being of paramount significance for competition across markets.
  • A right of access to data was also introduced, where access is of relevance for competition.^[5]
  • The German ‘essential facilities doctrine’ has been revised and widened, such that a refusal to provide access to data can now be abusive.^[6]
  • The concept of ‘intermediation power’ was introduced as a criterion for dominance in multi-sided markets. A company can be found to have intermediation power on the basis of its access to competitively relevant data.

‘Data’ and competition law

German legal framework for finding dominance

Generally, market power is defined as the ability to raise prices profitably above the competitive level. Under German law, there are distinct levels of market power; namely:

• single or collective dominance, where two or more companies have joint market power; and
• a superior market position in relation to other competitors, customers or suppliers (relative dominance).

Data’s role in identifying market power for both single or collective dominance and relative dominance is growing.

Criteria for assessing dominance and the impact of data questions

Section 18(3) of the ARC sets out the criteria to be considered for assessing dominance; namely:

• market share;
• financial strength;
• access to competitively relevant data;
• access to purchasing or sales markets;
• links with other undertakings;
• legal or factual barriers to market entry;
• actual or potential competition;
• the ability to shift supply or demand to other goods or commercial services; and
• the ability to switch to other suppliers or purchasers.

Specifically for the assessment of digital markets, the following additional – non-exhaustive – criteria for a finding of monopoly power^[7] were adopted as part of the 2017 revision of the ARC:

• direct and indirect network effects;
• multi-homing practices by users and users’ switching costs;
• economies of scale arising in connection with network effects;
• access to competitively relevant data; and
• innovation-driven competitive pressure.

As can be seen from the foregoing, data can have a significant effect on determinations of dominance. It has been introduced as an explicit criterion both in the general dominance assessment^[8] and in the assessment of dominance of multi-sided markets,^[9] and must be factored in alongside other criteria. This reflects the situation at European Union level,^[10] where access to data can be a barrier to entry. In German case law, data has been a factor in identifying market power. For instance, in the Facebook case (see below), the Federal Court of Justice (FCJ) found that access to competitively relevant data is a significant parameter in assessing market structure (in this case, in relation to online advertising) where attractiveness of the services is driven by the quality and quantity of data.^[11] Similarly, the FCO found that the German railway operator, Deutsche Bahn, has a dominant position in the (mobile) ticketing market and related services, inter alia, as it – in contrast with competitors – has access to live data on arrivals, among other things. Consequently, the FCO – as confirmed by the Higher Regional Court (OLG) of Düsseldorf – has required Deutsche Bahn to grant competitors access to its live data.

Relevance of data for assessing relative dominance

A peculiarity of German antitrust law is that the prohibition of abusive behaviour does not only apply to companies with single or collective market dominance. Section 20(1) of the ARC also extends these prohibitions to companies with relative market power. This applies where a company is dependent on another company in such a way that sufficient and reasonable alternatives do not exist.

As a result of the increasing relevance of data for competition, a dependency can also arise from the fact that an undertaking is dependent on accessing data controlled by another undertaking to carry out its own activities.

Data-related abusive behaviour and the Federal Cartel Office’s traditional toolkit

If an undertaking is considered to be dominant, it is prohibited under Section 19(1) of the ARC from abusing its dominant position. Section 19(2) provides five non-exhaustive examples of abusive behaviour, namely exclusionary conduct, discriminatory behaviour, exploitative abuse, structural abuse and refusal of access (essential facilities).

With regard to potentially abusive behaviour in connection with data, companies should be mindful of the following scenarios.^[12]

Excessive data processing

The FCO’s case against Facebook was based on alleged excessive data processing resulting in a violation of Section 19(1) of the ARC. Excessive data processing could technically also be covered by either Section 19(2)(2) (discriminatory behaviour) if other undertakings are granted different conditions (e.g., less data processing), or Section 19(2)(1) (exclusionary conduct) if other undertakings are hindered by the excessive processing.

Bundling of own data

The combining of data gathered from different intra-group services could be seen as creating or strengthening a barrier to enter the market. This could fall under Section 19(2)(1) of the ARC.

Impeding data processing by other undertakings

Undertakings can also restrict others from processing any of their customers’ data that could be used to offer additional services, inter alia, on an undertaking’s ecosystem that could compete with its services. This could fall within Section 19(2)(1) of the ARC.

Refusing to grant access to data

With the tenth amendment to the ARC, the legislator introduced a right to data access in Section 19(4). The legislator had the following fields of use^[13] in mind, in particular:

• A dominant company controls access to the data of a specific person or machine, and another company wants to offer additional services to the operator of the machine or the user of a service, but needs access to individualised data relating to the operator or user to do so.
• A company desires access to the aggregated data of a large number of users or machines to be able to better predict machine malfunctions or user needs.

The right to access, however, is subject to high hurdles. A general need or interest in the data is not sufficient. Rather, it would need to be evident that competition in neighbouring markets would otherwise be seriously jeopardised.

Facebook saga: an example of the Federal Cartel Office applying its traditional toolkit

On 6 February 2019, after almost three years of investigation, the FCO issued its landmark decision on Facebook’s data collection practices. It found that Facebook had a dominant position on the German market for social networks for private users and abused this position by making use of the Facebook social network conditional on the user consenting to an extensive collection of user data from third-party websites and applications (apps) (including services owned by Facebook, such as WhatsApp and Instagram) and linking that data to the users’ Facebook accounts. In its background paper on the case (published at the end of 2017), the FCO had given an insight into its theories of harm:

• harm to consumers through the loss of control over how their personal data is used; and
• harm to competition:
  • on the user side of the market, as the combination of data allows Facebook to optimise its own service and bind additional customers to its service; and
  • on the advertising side of the market as Facebook can use the data to improve its targeted advertising, making its social network indispensable for an increasing number of advertising customers.

The FCO assessed Facebook’s conduct as an exploitative abuse through the imposition of exploitative business terms (under the ARC, Section 19(1)). When assessing whether Facebook’s terms and conditions were abusive, the FCO relied heavily on data protection principles under Regulation (EU) 2016/679 (the General Data Protection Regulation (GDPR))^[14] and concluded that Facebook’s behaviour violated these. The FCO based this approach on three precedents by the FCJ,^[15] from which the FCO inferred that non-competition law principles that are concerned with the appropriateness of conditions in unbalanced negotiating situations can be a benchmark when assessing whether terms and conditions are abusive. With regard to the question of whether and to what extent a causal link between dominance and the abuse is required, the FCO took the view that it is not necessary to establish strict causality between the abuse and market power. Rather, the FCO considered normative causality or result causality to be sufficient, meaning that, in the FCO’s view, it is sufficient that the behaviour turns out to be detrimental to competition as a result of the market dominance.

The FCO prohibited the use of the terms of services under scrutiny and the underlying data collection practices (Facebook had to comply with this order within 12 months). Facebook appealed and sought interim relief at the OLG Düsseldorf, pending the outcome of the main appeal.

On 26 August 2019,^[16] the OLG Düsseldorf granted a temporary injunction, suspending the FCO’s decision pending the outcome of Facebook’s appeal. The Court found that there were serious doubts as to the lawfulness of the FCO’s decision as required under the test for suspending the FCO’s decision. The Court considered that terms and conditions set by a dominant company will only amount to an abuse of that dominance in breach of competition law if they cause competitive harm. The Court rejected the FCO’s assertion that Facebook’s terms and conditions caused competitive harm by either exclusion of competitors or by way of exploitation of dominance to the detriment of consumers.

In particular, the OLG Düsseldorf emphasised that an infringement of data protection law by a dominant company does not automatically amount to an abuse of that dominance. Rather, it must be shown that the relevant conduct or infringement of data protection law (or any other consumer protection law) would not have been possible under competitive conditions (i.e., there is a causal link between the conduct and the company’s market power). The Court held that the latter had not been demonstrated by the FCO in this case. In assessing whether terms and conditions set by a dominant company are abusive, it is necessary to consider the terms and conditions that would have been likely to emerge in a more competitive market. The Court considered that the FCO had failed to properly consider this.

Furthermore, the Court considered that the FCO had not demonstrated that the provision of data to Facebook restricted the ability of other companies to compete. In particular, it had not substantiated that the processing of the data leads to the establishment or reinforcement of barriers to entering the market.

The Court also rejected the FCO’s assertion that Facebook users are harmed by a loss of control over their data, with no option to opt out of data collection and processing if they wish to use the Facebook social media platform. The Court considered that each user can decide whether to accept Facebook’s terms and conditions, weighing up the pros and cons of using an advertising-funded social media network that is reliant on user data.

On 23 June 2020,^[17] the FCJ overturned the temporary injunction. It found that there were neither serious doubts that Facebook was dominant on the German market for social networks, nor that Facebook abused this dominant position through its terms of service. The FCJ considered that Facebook’s terms of service do not leave users a choice as to whether they (1) want to use the network on the basis of a more intense personalisation of the user experience, including potentially unlimited access to elements of their off-Facebook internet use, or (2) only agree to a level of personalisation that is based on data that the users themselves release on Facebook. This approach differs slightly from the approach taken by the FCO (which focused on data protection aspects).

In its decision of 24 March 2021,^[18] the OLG Düsseldorf disagreed with the FCJ, suspended the proceeding and referred the case to the Court of Justice of the European Union (CJEU) for a preliminary ruling under Article 267 of the Treaty on the Functioning of the European Union (TFEU). It expressed doubts as to whether (1) national competition authorities may review and assess compliance with GDPR rules, (2) the operator of an online social network may process users’ sensitive personal data under the GDPR, (3) the processing of data can be legitimated under Article 6 of the GDPR and (4) consent given to an undertaking with dominant position is valid.

The CJEU ruled on 4 July 2023^[19] in favour of the FCO, confirming that competition authorities can be allowed to assess compliance with data protection law, under certain circumstances; however, the CJEU provided clear guidance as to when competition authorities can base their assessment on data protection law:

• When examining an abuse of a dominant position, competition authorities must also assess compliance with data protection law. Otherwise, the reality of this economic development would be disregarded.
• To ensure consistent application of the GDPR, the national competition authority and the relevant data protection authority must cooperate. Where there is an existing decision on the relevant data protection question by the relevant authority, the competition authority is bound by that; if there is no decision, the competition authority has to reach out to the data protection authority to reach a decision about the conduct.
• Where the requested data protection authority does not respond to the competition authority within a reasonable time (undefined) – or does not object – the competition authority may continue its own investigation.

The CJEU concluded that Facebook could not benefit from consent from users to process data.

The CJEU stated that the existence of a dominant position can affect the validity of a consent, since there is a clear imbalance between the user (data subject) and the controller (Facebook). Since the data processing at issue was not strictly necessary for the performance of the contract between the user and Facebook, users need to be free to choose to refuse to give consent to particular data processing operations that are not necessary for the performance of the contract without being excluded from the service. As a potential solution, the CJEU identified ‘pay-to-play’ solutions, whereby users are offered equivalent alternatives to data processing for an appropriate fee.

Regarding other permissions, the CJEU found that Facebook cannot benefit from an exemption under Article 6(1)(b) of the GDPR (necessary for the performance of a contract) on the basis that neither collecting ‘off-Facebook data’ for the purpose of personalised advertising nor forwarding the data to other Meta group companies is necessary to offer a social network service.

Additionally, there is no legitimate interest in data processing^[20] as the individual users’ rights override the interests of the operator in providing personalised advertising and it is questionable whether general aspects of product improvement can override individual rights.

The CJEU sent the assessment of whether there is a legitimate interest for data processing to comply with legal obligations^[21] back to the OLG Düsseldorf, leaving it to ascertain whether Meta is legally obliged to collect and store data to be able to respond to a request for data from a national authority.

However, following a settlement in October 2024 between the FCO and Meta, Meta withdrew its claim and the FCO concluded its proceeding, making the FCO decision from 2019 legally binding. Under the settlement, Meta agreed to implement certain measures to meet the FCO’s requirements. Although the settlement decision is not published, information published by the FCO suggests that the measures include the following:

• Introducing an Accounts Centre to keep data collected from Meta’s different services separate: The Accounts Centre allows users to decide themselves which Meta services (e.g. Facebook and Instagram) they would like to connect and thus allow data to be shared between these services also for advertising purposes. It is still possible to use the services separately without experiencing a significant loss in quality.
• Introducing “cookie” settings that allow Facebook data to be separated from other data: Facebook’s “cookie” settings now allow users to decide whether they want to allow their Facebook data to be combined with data Meta collects from third-party websites or apps using its so-called business tools. This also applies to Instagram.
• Special exception for Facebook Login: Users who choose not to combine their Facebook data with their data collected while using other websites or apps can make an exception for Facebook Login to still be able to use this log-in option in third-party apps or on third-party websites. Previously, users had to allow Meta to combine all user data with data from third-party apps or websites if they wanted to use Facebook Login.
• Concise customer information: To help Meta’s customers quickly find the relevant settings to prevent the unwanted combination of data by Meta, users who have agreed to data being combined in the past are shown prominent notifications when accessing Facebook. These notifications contain direct links to the newly designed consent options.
• User navigation: Meta has added a prominent notice at the beginning of its data policy, informing users about their options (“How to manage the info that we use”). This contains a short explanation and links to the Accounts Centre and “cookie” settings.
• Limited combination of data for security purposes: Regardless of the user’s settings in Facebook or Instagram, Meta stores and combines usage data for security purposes. However, this is done only temporarily and for no longer than a standardised period of time defined in advance.^[22]

Federal Cartel Office toolkit: Section 19a of the German Competition Act and the relevance of data

In addition to the established (but revised) abuse of dominance provisions, more far-reaching changes have been made to the German competition law landscape.

In 2021, the German legislator introduced Section 19a of the ARC, enabling the FCO to target companies of ‘paramount significance for competition across markets’. The rationale for this new provision is to tackle the perceived increased competitive risks of digital markets.

In a two-step procedure, the FCO can prohibit companies that have paramount cross-market significance for competition from engaging in certain practices that impede competition:

• The FCO determines whether the company is of paramount cross-market significance for competition.^[23] This designation is limited to five years once the decision is legally binding.
• The FCO can issue a decision (Verbotsentscheidung) prohibiting a company of paramount cross-market significance for competition from engaging in behaviours listed in Section 19a(2) of the ARC.

Section 19a of the German Competition Act: proceedings to date

The FCO has used Section 19a of the ARC extensively.

The first proceedings – against Meta (formerly Facebook) – followed nine days after the provision took effect and there has been a flurry of proceedings against the other GAMAM^[24] companies. The following provides an overview of the various proceedings.

Proceedings under Section 19a of the German Act against Restraints of Competition

Criteria to designate paramount cross-market significance

To be designated as an undertaking of paramount cross-market significance, two cumulative conditions must be met:

• The undertaking must be active to a significant extent on markets within the meaning of Section 18(3a) of the ARC (i.e., on multi-sided markets and networks).
• The undertaking must have a paramount cross-market significance for competition. Whether this requirement is met is determined by an overall assessment, taking into account the criteria in Section 19a(1)(2) of the ARC, which include:
  • a dominant position in one or more markets;
  • financial strength or access to other significant resources;
  • vertical integration and its activity in otherwise related markets;
  • access to competitively relevant data; or
  • significant activities for third-party access to procurement and sales markets and its associated influence on the business activities of third parties.

Relevance of data in assessing a company’s status

While Section 19a of the ARC is still a relatively new provision, cases to date indicate that access to competitively relevant data (supplemented with other aspects) is an important factor in determining whether a company has paramount cross-market significance.

All GAMAM companies – Google (Alphabet), Amazon, Meta (Facebook), Apple and Microsoft – have been designated as undertakings of paramount cross-market significance. One main factor for the FCO in each decision was the question of sufficient access to data.^[25]

• The FCO found, inter alia, that Google, via its complementary services, had broad access to data (including user data) and was able to merge data, resulting in access to significant amounts of data. More specifically, the FCO found that:

taking into account its portfolio of services and Google’s ability to merge data across services and in some cases across devices, its broad and deep access to data in this overall and specific form is of particular competitive relevance, as it gives Google a paramount position across the market.^[26]

In addition, the FCO found that the data (as well as other resources, such as the Google brand) can be used as an input to help improve and expand services.

• The FCO found that Amazon has almost unique access to data, enabling it to prepare data analysis and estimates providing an in-depth understanding of customer preferences. In this way, Amazon has the ability to modify existing offerings and the opportunity ‘to close portfolio gaps and prepare a more reliable basis for business decisions’.^[27] Amazon has appealed the decision. On 23 April 2024, the FCJ rejected the appeal, confirming that Amazon is an undertaking of paramount cross-market significance. The FCJ again clarified that Section 19a of the ARC does not require a concrete impediment of competition but targets undertakings whose resources and strategic position allow them to exert considerable influence on the business activities of third parties, distort the competitive process to their own advantage and transfer their existing market power to new markets and sectors. In the FCJ’s view, these criteria are met. Amazon is active on a large number of intertwined different, vertically integrated markets and additionally has a dominant position in the German market for online marketplaces. In particular, Amazon was found to have significant financial resources and significant access to competitively sensitive data from different sources (e.g., customer data and data gathered from marketplace and its cloud service, AWS).^[28]
• Meta was found to be able to combine data from different sources in its broad ecosystem, resulting in access to large volumes of user personal data. This broad data access – according to the FCO – provides Meta with several advantages. From a cross-market perspective, the (user) data not only gives Meta the ability to strengthen user loyalty and further develop and adapt its product portfolio according to users’ needs, it also enables Meta to guide users to other services to further bind them to its system, and enables ‘monetisation of the overall offering in a cross-market sense’.^[29]
• The FCO found that Apple has a dominant position in the smartphone market via its iPhone.^[30] Through the dominance of its iPhone and its App Store, Apple has access to several exclusive data streams. This broad and ‘privileged’ data access enables Apple to further expand the competitive potential of its data, resulting in additional products. It also enables Apple to strengthen its dominant position. In that regard, the FCO found: ‘Apple’s outstanding market position is sustainably secured by a substantial resource endowment and privileged data access, as Apple is able to utilise the associated potential in the smartphone market to its own advantage and not only secure but also expand its market position and profits.’ Apple appealed the decision. On 18 March 2025, the FCJ rejected the appeal and confirmed that Apple is an undertaking of paramount cross-market significance. According to the FCJ, Apple operates a comprehensive ecosystem of hardware, software and digital services. In particular, the App Store was seen as a central distribution platform. However, to receive access to Apple device users, inter alia, third-party app developers are dependent on the App Store. In the FCJ’s view, this, combined with Apple’s market position, inter alia, in the smartphones segment, was sufficient to meet the criteria of Section 19a(1) of the ARC.

Having initiated proceedings in March 2023, the FCO confirmed, in its decision of 27 September 2024, that Microsoft is an undertaking of paramount significance. The FCO emphasises the development of Microsoft, building on ‘the historical starting point of the company’s overwhelming importance’ – the Windows operating system.^[31] It found that, from this position, Microsoft has created a digital ecosystem that has expanded across markets and, thanks to available resources, can be expanded to important new business areas such as cloud computing or artificial intelligence. Against that background, the FCO backed its decision, in essence, on five aspects under Section 19a(1) of the ARC, which, together, have a substantial cross-market impact, justifying the designation as an undertaking of paramount significance:

• market dominance;
• vertical integration;
• financial strength and access to other significant resources;
• access to data; and
• influence on market access by third parties.

In terms of market dominance (ARC, Section 19a(1)(1)),^[32] the FCO found that Microsoft holds a dominant position in, among others, PC operating systems, server operating systems, productivity software and cloud computing, supported by high market shares and significant barriers to entry for competitors.

Taking into account vertical integration (ARC, Section 19a(1)(3)),^[33] the FCO noted that Microsoft’s products are highly integrated across various markets, creating a comprehensive digital ecosystem. This integration spans from operating systems (Windows) to productivity software (Microsoft 365), cloud services (Azure) and more. The interconnectedness of these products enhances Microsoft’s market power.

Furthermore (as required under ARC, Section 19a(1)(2)),^[34] Microsoft’s financial capabilities were found to be exceptional, with substantial revenues, profits and market capitalisation. This financial strength allows Microsoft to invest heavily in research and development, acquisitions and market expansion, further solidifying its market position.

Microsoft additionally has extensive access to valuable data across its various platforms and services (ARC, Section 19a(1)(4)).^[35] This data is crucial for improving existing products, developing new ones and maintaining a competitive edge. The ability to leverage data across different markets contributes to Microsoft’s significant market influence.

Conduct that can be prohibited under Section 19a of the German Competition Act

Section 19a(2) of the ARC identifies conduct by designated undertakings of paramount cross-market significance that can be prohibited by the FCO. This exhaustive list includes the following:

• Self-preferencing:^[36] Prohibitions on self-preferencing can be imposed on (vertically integrated) undertakings that are active as an intermediary and at the same time compete on the intermediated markets. In Section 19a(2)(1)(a), the legislator intended to address scenarios such as the Google Shopping case^[37] (i.e., preferencing intermediation services on the search platform). Section 19a(2)(1)(b) covers cases in which, for example, apps are pre-installed, thereby foreclosing market opportunities for providers of competing apps.^[38]
• Impeding other companies’ activities:^[39] In contrast to the above, Section 19a(2)(2) is focused on self-preferencing behaviour outside inter­mediary services. Section 19a(2)(2)(a) covers pre-installed apps or search engines in a web browser. Section 19a(2)(2)(b) covers situations where other companies are hindered in promoting their offerings or reaching customers via other access points, attempting to protect their own digital ecosystem.
• Platform envelopment:^[40] This covers circumstances where the undertakings of paramount cross-market significance are in a position to rapidly expand their market position, in particular via bundling (Section 19a(2)(3)(a)) or tying (Section 19a(2)(3)(b)) to leverage their position into other markets, strengthening their existing ecosystem.
• Impediment through data processing:^[41] To avoid creating or strengthening market entry barriers, undertakings of paramount cross-market significance can be prohibited from making use of a service conditional on the user agreeing either to the processing of data relating to other services without providing choice (Section 19a(2)(4)(a)) or the processing of competitively relevant data received from other companies for purposes other than those that are necessary to provide its own services to these companies (Section 19a(2)(4)(b)).
• Impeding interoperability:^[42] To avoid ‘lock-in’ situations, where users are restricted in their choice of a product, conduct impeding interoperability of products or services, or data portability, can be prohibited.
• Withholding information:^[43] Undertakings of paramount cross-market significance can be prohibited from not sufficiently informing users of the use being made of the data they provide. This includes situations where the undertaking uses data for its own benefit (including for advertising).
• Requesting disproportionate benefits:^[44] Similarly to Section 19(2)(5) of the ARC, an undertaking of paramount cross-market significance can be prohibited from requesting disproportionate benefits from another undertaking. This applies in scenarios where the undertaking requests data that is not required to provide the relevant service (Section 19a(2)(7)(a)) or where it makes the quality of the service provided conditional on the receipt of data (Section 19a(2)(7)(b)).

Federal Cartel Office’s new toolkit: key takeaways from a data-related perspective

The FCO has opened several proceedings addressing conduct by entities designated as being of paramount cross-market significance under Section 19a of the ARC, many of which have a data angle.

Proceedings against Alphabet

The FCO has conducted several proceedings under Section 19a of the ARC to prohibit specific behaviour by Alphabet.

In 2023, the FCO issued a prohibition order under Section 19a(2)(4)(a) addressing alleged conduct by Alphabet^[45] to exploit its customers by making the use of its services conditional on consent to data processing (‘take it or leave it’), including the processing of data from group intern services and from third-party providers. While it is technically possible to personalise processed data, the FCO found that there is insufficient choice. According to the FCO, users should be able to differentiate between the data processing purposes, to limit data processing to a specific service, and limit the circumstances, purpose and manner of data processing.

The FCO found that Google leverages its capacity to extract and collect data from its users to build a competitive advantage for itself. The FCO required Google to grant users the opportunity to consent to cross-service data processing on a voluntary, informed and unambiguous basis for specific cases. As a result, Google must offer appropriate and neutral options for data consolidation, and choice boxes have to be designed in a way that users are not manipulated to accept cross-service data processing (avoidance of ‘dark patterns’). In response, Google pledged not to use data processing conditions that enable it to (1) merge personal data from a service with personal data from other Google services or with personal data from third-party services or (2) continue to use personal data from a service in other separately provided Google services and vice versa, without offering users sufficient choice to consent to or reject this cross-service data processing. Since Google is also subject to the regulations under the Regulation 2022 (EU) 2022/192(Digital Markets Act), the commitments exclude core platform services in connection with which Google has been designated as a gatekeeper (e.g., Google Shopping, Google Play, Google Maps, Google SearchYouTube, Google Android, Google Chrome and Google’s online-advertising services). The FCO decision thus applies to Gmail, Google News, Assistant, Contacts and Google TV.

In addition, the FCO opened two proceedings under Section 19(a) of the ARC to assess Google Maps and Google Automotive Systems. Following commitments offered by Alphabet, both cases were concluded on 9 April 2025.^[46]

In the Google Maps proceeding, the FCO investigated the extent to which Alphabet was using the platform to hinder other map services in procurement or sales markets. In the Concrete case,^[47] Google, via its terms of services, restricts merging Google Maps services with third-party map services. Additionally, according to the FCO, certain clauses prevent the display of Google content on non-Google maps, prohibit the recreation of Google products or features and exclude the use of Google Maps platform services in embedded vehicle systems. In the preliminary view of the FCO,^[48] the restrictions would infringe Section 19a(2)(1)(3b)(5) of the ARC as, in particular, they hinder the interoperability of Google Maps platform services with third-party services, affect developers and competitors and lead to a de facto bundling of Google services, limiting the ability of competitors to offer their services alongside Alphabet’s services. On 5 March 2025, Alphabet submitted finally binding commitments according to which Alphabet will remove the contractual provisions restricting the combined use of Google Maps services with map services from third-party map services, such as HERE, Mapbox and TomTom. This will not only allow third-party map developers to use Google Maps services, it will also have an effect on vehicle information systems where Google Maps can now be used with third-party services (see below). Geographically, the commitments apply to customers (i.e., licensees) of Google Maps services with billing addresses in the European Economic Area. In addition, with regard to vehicle information systems, the commitments will apply to all cars that are, or can be, registered in Germany. Due to the European Union-wide consistent registration requirements, this applies to all cars in the European Union.

In parallel with the above, in the Google Automotive Services proceeding, the FCO found, preliminarily,^[49] that Google’s (Alphabet’s) behaviour in relation to Google Automotive Services violates Section 19a(2) of the ARC. Google Automative Services is a bundle consisting of Google Maps, a version of Google Play and Google Assistant, which Google offers to car manufacturers for licensing. Together with the Android Automotive Operating System, it provides a complete vehicle infotainment system. However, the FCO found that, by bundling Google Maps, Google Play and Google Assistant in the Google Automotive Services, Alphabet restricts vehicle manufacturers from choosing individual services. This bundling – in the preliminary view of the FCO – was seen as an automatic connection of services (Section 19a(2)(3a)) and as linking the use of one service to the use of another service (Section 19a(2)(3b)). In the meantime, Alphabet had terminated agreements with car manufacturers that included revenue sharing from advertising, conditional on the exclusive installation of Google Automotive Assistant. Those revenue-sharing arrangements created incentives for car manufacturers to exclusively pre-install Google Automotive Services (Section 19a(2)(2a)). Furthermore, Google required default settings and prominent placement of its services in the user interface, which could reduce the use of alternative services, limiting the competitive freedom of other service providers, having an effect comparable to pre-installation requirements (Section 19a(2)(2a)). Last, the FCO criticised Google’s practice in the past of restricting the interoperability of its services with third-party services (Section 19a(2)(5)). This lack of interoperability between Google’s services and those of other providers is seen as a significant barrier to market entry for competitors.

To tackle these concerns, Alphabet offered commitments under which it will license the services contained in Google Automotive Systems also as separate stand-alone versions. Additionally, Google will remove restrictive contractual provisions that have created incentives for customers to use Google services, including provisions on default settings or participation in advertising revenue. Further, ‘Google has also committed to create the necessary conditions to enable interoperability with third-party services.’^[50]

Meta/Oculus

In December 2020, the FCO initiated a proceeding under Section 19 of the ARC and Article 102 of the TFEU to assess potential tying concerns regarding the requirement that users of Meta’s virtual reality (VR) headset Quest 2 (formerly Oculus) use a Facebook account. Following the implementation of Section 19a of the ARC, the FCO revised the legal basis for the proceeding and designated Meta as an undertaking of paramount cross-market significance in May 2022.^[51] Applying Section 19a(2)(3) meant that the FCO did not have to establish a ‘tying’ theory of harm. It could prohibit the requirement that use of a service was conditional on the use of another service provided by the undertaking (where the former service did not need the latter), without giving the user sufficient choice as to whether and how the services are used.

The FCO’s preliminary findings suggested that Meta was linking the use of Quest 2 VR headsets to a Facebook or Instagram account: it was not possible to set up the headset with a ‘foreign’ email account. Meta was alleged to be forcing Oculus customers to become part of Facebook or Instagram irrespective of whether they wanted to use these services. To address these concerns, Meta amended its practice. Customers no longer have to set up a Facebook or Instagram account but can register a stand-alone Meta account to use Oculus. Following this amendment, the FCO agreed that the VR headset Quest 2 (and the new Quest Pro) can now be sold in Germany. However, the FCO explicitly did not terminate the proceedings for two reasons. First, it wants to assess the actual implementation of this option to use the VR headsets without being forced to set up a Facebook or Instagram account, and second, the FCO – as a separate matter – continues to assess Meta’s data processing practices across its services.

With regard to the latter, there is a concern that linking Quest VR accounts with other Meta accounts could lead to extensive data linkage across Meta’s network, potentially violating Section 19a(2)(4) of the ARC. The FCO wants to ensure that users have a real choice to agree to data processing, because they have sufficient options to limit the amount of processed data to that required to fulfil contractual obligations.

Proceeding against Apple

In 2022, the FCO initiated abuse proceedings against Apple under Section 19a(2) of the ARC regarding its tracking regulations and its App Tracking Transparency Framework (ATTF).

The FCO is examining whether Apple’s tracking rules for independent publishers of apps on its iOS operating system can be considered to be self-preferencing^[52] or hinder competition from other companies.^[53] On 13 February 2025, the FCO issued its preliminary legal assessment informing Apple that, in its view, the ATTF raises competition concerns as Apple may prefer its own apps to those of third parties. The FCO focused on three aspects of the ATTF in particular, namely:

• the ATTF rules on tracking do not apply to Apple’s own combination of user data from different services in its ecosystem;
• third-party apps show the user up to four consent dialogues, whereas Apple apps show only two at most, limiting user choice; and
• this limited choice steers users towards allowing Apple to process their data while refusing processing by third-party developers.^[54]

Apple can now comment on this preliminary assessment.

Proceedings against Amazon

The FCO has two pending proceedings against Amazon. In the first, it is investigating price control mechanisms.^[55] This involves algorithmic review of the pricing of third-party retailers using the Amazon marketplace. According to the FCO’s initial view, applying these mechanisms can lead to retailer offers being harder for end customers to find or even blocked. To test this, the FCO has initiated an online survey of 2,000 third-party retailers to gather information about the effects of Amazon’s price review on their behaviour.^[56]

The second proceeding is in respect of ‘brand gating’. The FCO is investigating possible downsides for marketplace retailers through various Amazon instruments, such as agreements with (brand) manufacturers that could exclude third-party retailers from selling (branded) products on the Amazon marketplace.

Endnotes