Why end-user consent cannot keep markets contestable: A suggestion for strengthening the limits on personal data combination in the proposed Digital Markets Act

A central source of Big Tech gatekeepers’ power is their encompassing access to individuals’ personal data. By combining personal data across the range of services they provide, gatekeepers are able to create increasingly precise profiles of individuals. Their control over vast amounts and sources of data may not only erode the privacy interests of individuals but can also strengthen gatekeepers’ competitive advantage over business users and rivals.

The prohibition of Article 5(a) of the proposed Digital Markets Act (DMA), therefore, is welcome as an attempt to limit the private power over data held by gatekeeping platforms. This provision requires a gatekeeper to refrain from combining personal data sourced from its core platform services with personal data from other services offered by the gatekeeper or third parties, unless the end-user provided consent under the General Data Protection Regulation (GDPR). The prohibition is based on the remedy imposed by the German Bundeskartellamt in its 2019 Facebook decision.

However, end-user consent cannot be regarded as an adequate safeguard for keeping data-driven markets competitive. To undo the competitive harm resulting from Facebook’s practices, it is submitted here that the Bundeskartellamt should have imposed a more far-reaching remedy. For the same reason, the DMA should not rely on end-user consent as a mechanism to keep markets contestable, where gatekeepers wish to combine personal data. Rather, gatekeepers should only be able to combine personal data across services under the DMA when this is necessary to perform a contract.