The regulatory insider

To remain on the same frequency as the US antitrust trial and the CMA investigation, EU antitrust officials have let news outlets know that while they are considering ordering Google to end anti-competitive practices in its AdTech ventures, they should not be ordering a breakup of a giant’s AdTech business (despite having previously ominously hinted to it), due t the complexity involved. Vestager’s suggestion on how to tackle Google abuses would be for Google to sell its sell-side tools DFP and its own ad exchange AdX to avoid any self-preferencing.

On the 10th September 2024, the CJEU confirmed the Google shopping antitrust decision from 2017, rejecting Google’s appeal in its entirety and upholding the €2.4 billion fine. This judgment brought useful competition case law insights, with notably a precision from the judges, who specified that the Commission is required to assess self-referencing practices on a case-by-case basis before categorizing them as illegal, and thus imposing a heavier burden of proof for the Commission. The CJEU also delivered another decision in the Commission’s favour recently on Apple's illegal tax breaks in Ireland.

The new Commission has yet to be formed, but nominees for EU commissioners have been put forward by the Member States, except for Belgium who missed the deadline. The nominees will have to pass the EU Parliament scrutiny to be approved. The current list remains however interesting as these will most likely be, pending their approval, the main players during the next mandate, and will have to handle a variety of agenda, some more ‘important’ than others.

A new bill on AI regulation coming from California is said, by expert and professors on the topic, to possibly become a strong inspiration to strengthen EU’s own regulation on AI models. Among the obligations that this bill could bring forward, should it be passed, is mandating developers of AI models that are trained with more than $100 million worth of computing resources to follow and disclose a Safety and Security Plan (SSP) to prevent their models from causing “critical harm” (meaning here mass casualties or material damages exceeding $500 million). Besides, a Commission official stated that their AI office closely followed the Californian bill through the Commission’s San Francisco Office. A quite contested piece of legislation, the California bill has yet to become law as California Governor Gavin Newsom still has to sign the bill, the deadline being 30 September 2024.

With all the whirlwind around Telegram and the arrest of its founder in France, the EU is also probing the possible failures by the platform regarding the new digital regulations under the DSA, notably failing to provide accurate user numbers. EU experts suspect that the app deliberately understated its presence in the EU to stay under the threshold of 45 million users (declaring only 41 million) and thus evading specific regulations reserved for large online platforms in the EU.

The Commission is conducting an investigation into X in relation to the riots in the UK, as to how the riots could be potentially influenced by how the platform is being handled regarding those riots. EU officials already issued charges again X under the DSA last months to address a lack in tackling illegal content and risks to public security (advertising transparency, disinformation...). The Commission is therefore ‘closely following’ the situation, and notably X’s response to it.

With the US recent court ruling, affirming that Google indeed has an illegal monopoly in the search engine and advertisement market, the US legal system is showing a certain mirroring of the EU’s digital competition regulation. It remains to see if the US is truly affected by a certain ‘Brussels effect’, but the future antitrust rulings will be interesting to follow.

In total, around 700 companies signed the European Commission initiative introduced to help companies anticipate the application of the AI Act, which entered into force on Thursday 1st August 2024 and will see its measures applied two years later, besides some exceptions such as the general-purpose AI rules applying one year after entry into force. This shows a rise of 550 companies compared to the first call to sign the Pact last November. This AI Pact aims at letting businesses anticipate the regulation through voluntary commitments and AI Office’s workshops.

TikTok is not the only target of this privacy crackdown in the US, as Meta will have to pay 1.4 billion dollars to settle out of court the investigation launched in 2022 by Texas Attorney General Ken Paxton accusing Meta of illegally collecting biometric data. The tech giant was accused of collecting and storing, without the consent of the individuals concerned, the personal biometric data of millions of Texans, such as those contained in photos and videos posted online, using notably facial recognition.

Barely a couple of weeks ago, Google announced a major twist to their Privacy Sandbox plan: third-party cookies will actually not disappear. Sparking anger among ad execs, feeling forced to follow Google as the latter explained that users will get to decide if they want to be tracked or not. Nevertheless, a lot has to be figured out before we get a clearer picture, as google does not appear to have any timeline as of yet when it comes to the Sandbox. While some like Criteo are trying to reassure sceptics, affirming that Google won’t pull an Apple (who used language discouraging tracking), the question of consent and user choice when it comes to tracking and the cookies that will be left is back in the forefront.

Elon Musk’s X continues to face issues complying with EU regulations. The latest is with the DSA, the digital regulation seeking to make platforms take more responsibility for protecting users and moderating harmful/illegal content, with the EU stating that the ‘blue checkmarks’ used on X are deceptive as they constitute ‘dark patterns’, not being in line with industry best practices. The online platform is also falling short on the transparency and accountability requirements, notably not complying with ad transparency rules nor giving researchers proper access to public data. Musk answered these accusations by stating that “The European Commission offered X an illegal secret deal: if we quietly censored speech without telling anyone, they would not fine us”, also stating that he will take the Commission to court. European Commissioner Thierry Breton denied the existence of any ‘secret deal’.

Apple reached a settlement regarding a 4-year EU antitrust investigation into its Apple Pay service, avoiding what could have been a hefty fine. Apple pledged to allow payment rivals to access their technology of ‘tap and go’ payments, following complaints from banks and payment providers of Apple hampering the use of the iPhone’s near-field communication chip (NFC). This settlement seeks to prevent Apple from excluding other mobile wallets from their ecosystem, thus effectively allowing other payment providers to compete with Apple Pay on iPhone, for 10 years and free of charge. If Apple fails to respect their commitments, they would be liable for a fine.

Epic Games has been accusing Apple of arbitrarily obstructing the opening of its iOS app shop, claiming that the giant rejected their application for certification of its shop for a second time. They shared their complaints with the European Commission stating that this behaviour is in violation of the DMA. The aim of this certification is to allow iPhone users to download apps bypassing the official App Store. According to Epic Games, Apple's reasoning behind this rejection concerns the download and payment buttons which are too similar to those on the App Store. The DMA does however allow these alternative application shops, requiring Apple, a gatekeeper, to allow third-party app stores on the iPhone. Eventually, Apple approved Epic Games’ third-party app marketplace which will launched in the EU, but this case does show how difficult it may be to reach Apple’s criteria even under those new rules permitting third-party app stores on iOS.

The long-awaited Draghi report has been the talk of the town in Brussels since its publication, notably for its alarmist discourse on EU digital power and how to handle the tech and telco issues. Draghi follows in the established ideologies of telecom deregulation thrusted forward by Thierry Breton in 2023, saying that EU telecoms lack economies of scale and suffer from an outdated competition policy. While not everyone agrees with Draghi’s solutions to the problem he's presenting, especially as it tends to mainly benefit large telecom companies, the EU struggles to catch up to the US and China.

In quite a surprising and abrupt move, Breton resigned with a letter, posted on his X account, accusing Ursula Von der Leyen of trying to get Emmanuel Macron to remove him from the French Commissioner bid. This could affect the formation of the College of Commissioners. But rather rapidly, France, despite having yet to form a government of its own, already found Breton’s substitute with Stéphane Séjourné stepping up for the job.

X’s troubles continue, and are not limited to the EU, as Brazilian Supreme Court ordered that X be suspended in their country as the platform did not meet a deadline to appoint a legal representative in the country. This suspension will be applied until all court orders and fines are complied with. Musk responded quite vehemently stating that Brazil was ‘shutting down the #1 source of truth’, as he similarly did when reacting to the new EU legal obligations.

The Commission seeks to gain more information regarding Meta’s deprecation of its CrowdTangle transparency tool, with its access being shuttered on August 14. The EU Commission, already worried about the timing of this deprecation ahead of the European elections, introduced a new request for information on Meta under the DSA, to notably ensure that Meta does provide information on the measures taken to comply with its obligations to give researchers certain data and the election monitoring, inquiring about details on the content library and the API to ensure the compliance with the DSA transparency obligations. Meta has until September 6th to provide the requested information.

Musk’s X continues to raise legal issues all around, being the target of 9 privacy complaints in the EU. This comes after X is accused of grabbing EU users’ data to feed and train Grok, X’s AI model, without people’s consent. The Irish DPC, in charge of monitoring X’s compliance with the GDPR, expressed its surprise upon learning of this behaviour, with noyb criticizing the authority’s history of passivity when it comes to big tech’s infringements. The DPC has already taken action against X’s AI model training, and noyb has filed GDPR complaints in Ireland but also 7 other countries.

The first DSA investigation has shown its results with the Commission making TikTok’s commitment to permanently withdraw TikTok Lite Rewards programme from the EU Binding. The concerns raised by the Commission during their formal proceedings under the DSA have thus concluded with this settlement, a first ‘success’ for the Digital Services Act.

The European Commission is seeking to increase its capacity in monitoring marketplaces through the DSA, opening a call for tenders until 12th September to ‘develop the Union expertise and capabilities regarding systemic and emerging issues across the Union and to monitor the effective implementation and compliance with Regulation (EU) 2022/2065 by providers of the very large online platform and of the very large online search engines to support the activities of the enforcement teams’, with a budget of €12 million over three years. Among the tasks described by the call, one particularly aims at monitoring the compliance of the online advertising sector and marketplaces. This is not the only DSA related endeavour from the Commission, as it also recently launched a call for contributions (opened until 30th September) with the goal of collecting stakeholders’ views on the approach adopted for the drafting of the guidelines on the protection of minors (Article 28 DSA).

The US is reinforcing its legislation regarding online safety and privacy to better protect minors online through the adoption of two bills on 30th July: the Children and Teens’ Online Privacy Protection Act (COPPA 2.0) and the Kids Online Safety Act (KOSA). COPPA 2.0 focuses on adding data protection measures such as banning advertising targeting children and teenagers. KOSA requires social networks to prevent and mitigate any harm affecting minors due to content promoting self-harm, suicide, substance abuse or eating disorders. While the CCIA lobby denounced the legislation before its adoption affirming it would end up ‘doing more harm than good’, this crackdown comes right before the US Justice Department announced suing TikTok on massive privacy violations of kids under 13.

Elon Musk also shone in other fields lately, this time going against (yet again) the advertising industry. A report from US House Judiciary Committee, led by Republicans, accused WFA’s Global Alliance for Responsible Media (GARM) of breaching US antitrust laws, with voices such as Musk describing the GARM initiative as a ‘cartel’ which imposes ‘censorship’ and goes against free speech (especially against conservative political narratives), stating X will file suit against this initiative. The report itself accuses GARM of collusion aimed at reducing advertising revenue of certain media such as X or suppressing voices that they disapprove of. GARM’s aim is to set brand safety policies to ensure that ads are not being placed next to or funding harmful content. While Musk is threatening GARM with legal action, companies such as Apple or IBM did see their ads appearing alongside pro-nazi content on X last year, explaining initiatives such as GARM seeking to guarantee brand-safety.

The number of professionals in the advertising field taking issue with Google’s Privacy Sandbox is not going down, far from it. Ad execs, forced to turn towards such alternatives with the looming cookie deprecation, are warning that if the profits plummet, they will have to suffer the financial and legal consequences, not Google. A recent tech glitch in the sandbox gave them a glimpse of such a dreadful possibility. Ad execs are particularly worried about the Sandbox terms of service as it does not guarantee that ‘the coordinator service will meet your requirements’, shielding Google from any legal liability. Overall, Google seems to be imposing a severely one-sided contractual relationship through their ToS for a still deeply flawed technology, but Ad execs nonetheless feel compelled to adapt to avoid being marginalized. Moreover, the Privacy Sandbox still has to deal with other substantial issues as it still falls short from complying with the GDPR, as Google struggles to accommodate privacy and safeguarding ad performance.