WhatsApp was founded in 2009 by Brian Acton and Jan Koum on a simple principle of, “No ads! No games! No gimmicks!” The instant messaging app quickly became popular, growing to become the world’s biggest cross-platform mobile messaging service, with high penetration rates, both in developed country markets such as Europe and in mobile-first emerging markets such as India and Brazil.
By 2014, WhatsApp was on the path to reaching a billion users and all set to overtake Facebook’s (now Meta) messenger. Its presence could no longer be disregarded by Facebook’s leadership, whose approach to up-and-coming competition has been to neutralize the threat by buying it up. “It is better to buy than compete,” CEO Mark Zuckerberg reportedly said in 2008.
And so, in 2014, Facebook bought WhatsApp for a whopping price tag of USD 19 billion, much higher than its then valuation. The acquisition of WhatsApp was a win-win for Facebook. Not only did it eliminate a potential competitor, which could credibly challenge Facebook’s monopoly market, but WhatsApp and its 500 million users’ data was nothing less than an unopened treasure chest for the platform’s advertisement-driven business model.
At the time, the US Federal Trade Commission cleared the acquisition on the condition that WhatsApp continue to honor its promise to users and obtain affirmative consent before making any material changes to how it would use data already collected from them
Likewise, even though it recognized the potential for data concentration issues and privacy concerns, the European Commission (EC) also approved the acquisition in 2014 on the basis that Facebook Messenger and WhatsApp were not close competitors and that consumers would continue to have a wide variety of alternative communication apps even after the acquisition. Issues stemming from Facebook’s access to WhatsApp data, it held, would be a matter for data protection law rather than competition.
The acquisition of WhatsApp was a win-win for Facebook. Not only did it eliminate a potential competitor, which could credibly challenge Facebook’s monopoly market, but WhatsApp and its 500 million users’ data was nothing less than an unopened treasure chest for the platform’s advertisement-driven business model.
Since then, WhatsApp has become the most popular messaging platform in the world. With two billion users, its penetration rate (amongst Internet users aged 16-64) is above 80 percent in Europe and other emerging market countries such as Brazil, Turkey, Colombia, and South Africa. In the Global South in particular, it is the default mode of communication. In India alone, WhatsApp has more than 400 million users.
Data Sharing Between WhatsApp and Facebook
Digital platforms rely heavily on the data they collect from their users. In this context, the fact of Facebook integrating WhatsApp user data becomes extremely relevant. In the case of WhatsApp, Facebook opted for a slow progression toward data sharing to keep WhatsApp users from jumping ship, not interfering with WhatsApp’s business model and privacy policies until the service reached 1 billion users in 2016.
That year, WhatsApp updated its privacy terms to share some user data with Facebook, which was previously collected on the condition that it would not be used or disclosed for marketing purposes with the parent company. The new update not only allowed Facebook to link users of its social services with WhatsApp users, but also fed intel on WhatsApp users’ operating systems, mobile country codes, mobile carrier codes, screen resolutions, and device identifiers. This kind of data collection opened a new path for tracking and ad targeting across Facebook family companies.
In January 2021, in a controversial move, WhatsApp updated its terms of service and privacy policy to expand on its practices around data sharing with businesses. WhatsApp users were sent notifications, asking them to accept these terms to continue using the app. This time, unlike in 2016, there was no opt-out option available. Take it or leave it: WhatsApp would be sharing its customers’ data with Facebook for marketing purposes, a privacy update that would come into effect by February 8, 2021.
The move caused a fair degree of public as well as regulatory uproar across the world, prompting an eventual rollback of the proposed policy. In particular, what has been interesting is the Turkish regulator’s response. First, an interim injunction was issued to stop Facebook from extracting WhatsApp users’ data with immediate effect. Second, the regulator was able to examine the intersections of competition law with issues of data privacy, consumer protection and theories of harm, highlighting in the process, effective directions for competition legislation in regulating Big Tech activities.
The Turkish Competition Authority vs.Facebook
In recent years, the Turkish Competition Authority (TCA) has become vocal about platform dominance and has focused its resources and attention on digital markets. TCA has kept its oversight on dominant online platforms, mostly through broad investigations conducted between 2015 and now. In 2020, the TCA began a sector-wide inquiry into digital markets and conducted ‘abuse of dominance’ investigations against Google. It also created a digital markets task force to closely monitor multi-sided platforms and algorithms, and their effects on both markets and consumers. TCA imposed administrative fines and other measures in relation to both global and local initiatives, including those of digital giants like Google and Microsoft, for infringement of competition law.
Following on the heels of these overtures, the TCA launched an ex-officio investigation into Facebook and WhatsApp in January 2021 over the messaging application’s changes to its data-sharing rules under Article 6 of the country’s competition law for abuse of dominant position.
Typically, the TCA implements a two-step process for the investigation of anti-competitive practices — a preliminary inquiry followed by an investigation. In recent years, particularly after the market turbulence caused by the Covid-19 pandemic, the Board has increasingly been initiating investigations without a preliminary step and using its investigative powers to collect evidence and assess whether the practice in question infringes upon competition rules. In this context, the TCA’s investigation of Facebook was regarded as the fastest way to initiate an investigation, as it came only three days after WhatsApp’s announcement.
In rapidly evolving technology markets, an anti-competitive conduct may result in an irreversible impact on competition and the market structure. Thus, interim measures are one of the most powerful enforcement tools available to competition regulators. Given that a competition investigation may run several years, interim injunctions can be issued to ensure that effective competition is maintained and that irreparable damage, which is incapable of being remedied, is averted. In this context, Article 9 of Turkey’s Competition Act authorizes the TCA to impose interim measures in circumstances where serious and irreparable harm can occur prior to the final decision of the Board. Citing the possibility of irreparable harm, the TCA also issued an interim injunction ordering WhatsApp to temporarily suspend the implementation of WhatsApp’s privacy policy update for Turkish users.
Given that a competition investigation may run several years, interim injunctions can be issued to ensure that effective competition is maintained and that irreparable damage, which is incapable of being remedied, is averted.
In its reasoning for the interim injunction, the TCA considered the market power of Facebook for: (i) consumer communication services, (ii) social media services, and (iii) online marketing services. It concluded that the new updates to WhatsApp’s data collection and sharing practices could lead to serious and irreparable harm to the market. The TCA was concerned that the new policy update would result in “more data being collected, processed and used by Facebook” to distort competition.
The TCA Investigation: Possible Theories of Harm
A theory of harm explains how a particular type of harm could amount to a breach of competition law and why that conduct hurts competition in a way that should be prohibited. It imposes a logically consistent approach to the assessment of anti-competitive behavior.
Considering Facebook’s dominance in the markets for consumer communication, social network services, and online advertising services in Turkey, the TCA articulated three possible theories of harm for this investigation: (i) complicating activities of competitors in the online advertising market (leveraging), (ii) tying, and (iii) exploiting consumers via excessive data collection.
Complicating Activities of Competitors in Online Advertising Market (Leveraging). The online advertising market is usually defined as a zero-price business. Online platforms attract consumers by offering their core services for free, in exchange for which, consumers give platforms both their attention and their data. Facebook’s business model relies on this model – attracting consumers’ attention and gathering data about them, which it then uses to send targeted advertisements. Facebook can often influence what users see and click. With 60 million social media users in Turkey, of which 38 million comprise a potential audience for Facebook ads, as a gatekeeper, Facebook has been leveraging the popularity of its services and apps, along with its data, to rapidly push smaller online ad providers out of the market. The TCA investigation thus focused on whether Facebook’s behavior leads to actual or potential anti-competitive foreclosure in the market.
Tying. Tying originally refers to the combined sale of more than one product. It describes a practice where the seller of the service (tying product/service) requires the buyers to also purchase another separate service (tied product/service). The assessment of tying requires two separate products and a dominant supplier with a market power denying customers a choice of supplier for the tied product. Tying should amount to anti-competitive foreclosure, which refers to a situation in which a firm eliminates or impedes an actual or potential competitor’s access to a market.
Facebook has long been planning to integrate Messenger, WhatsApp, and Instagram through a unified technical infrastructure. By integrating messaging apps, Facebook aims to keep users engaged with its various platforms, improve data points for its advertising business, and reduce consumers’ appetite for competitors. The integration plan raises privacy concerns as to how users’ data may be shared between services as well as competition concerns regarding the future of the market. Here too, the TCA found that the most recent policy update ties WhatsApp user data to Facebook. Combined with data collected from other Facebook services, WhatsApp metadata provides an unfair competitive advantage for Facebook in social media markets.
Consumer Exploitation. “Zero-price market”, refers to a market where firms set the price of products or services to customers at USD 0. These markets existed for years but with the advent of digital services, they have exploded in number, variety, and popularity. These “free” products/services are not actually free, they are exchanged within markets. In zero-price digital markets, consumers pay for the services with their personal data rather than with money. This means that the competition rules should make sure that consumers receive the best possible products/services without giving away vast amounts of personal data.
Digital markets are characterized by several market failures. Facebook’s business model depends predominantly on keeping users engaged with Facebook services and harvesting their data to keep them online using intelligent and flexible algorithms. The algorithms learn from, and respond to, data that manipulates consumers and leverages Facebook’s dominance in online advertising. Consumers get a data-intensive product with no choice over the use of their data. When asked, a broad majority of social media users indicate that they value their privacy but most of the time they do not necessarily act accordingly. This presents a so-called ‘privacy paradox’ for users as they tend to share personal data or give consent to third-party processing by simply “agreeing” with privacy policies without properly reading, let alone understanding, them. The lack of informed consent in combination with the user’s privacy paradox leads to a lack of transparency, which exploits information asymmetries and bargaining power imbalance between digital platforms and consumers.
Accordingly, the TCA regarded personal data as a fundamental part of commercial terms and prices. The Board emphasized that data shared through WhatsApp should be considered more confidential compared to the data shared through social media platforms. The former may contain more private personal information that WhatsApp users would not want to share with a broader group, unlike with Facebook, where data is shared with all members of a closed group.
Considering Facebook’s dominance in the markets for consumer communication, social network services, and online advertising services in Turkey, the TCA articulated three possible theories of harm for this investigation: (i) complicating activities of competitors in the online advertising market (leveraging), (ii) tying, and (iii) exploiting consumers via excessive data collection.
Hence, the TCA found WhatsApp’s take-it-or-leave-it privacy update, could prevent Turkish consumers from making informed choices or giving meaningful consent to data sharing between WhatsApp and Facebook, rendering it unfair from a competition law lens. The Board expressed concern for Turkish WhatsApp users regarding the fact that the scope of the data collected by WhatsApp was not limited to correspondence, contact lists, and photographs, as the data used by other apps installed on users’ devices may also be partially accessible to WhatsApp. It noted that the lack of clear and transparent information and options about user privacy and data sharing could amount to unfair trade practices. By unilaterally imposing an update, Facebook had lowered the quality of WhatsApp as a product and pushed users to receive the same online service by “paying” a higher price in terms of lowered privacy standards.
Unfair trading practices imposed by dominant online platforms such as Facebook could also, in principle, be sanctioned as an exploitative ‘abuse of dominant market position’. The Board held that excessive data collection and the extent to which such data is cross-linked with or processed by Facebook may have anti-competitive implications which, warranted a detailed investigation of anti-competitive practices.
Due to the unique nature of digital markets, data, and privacy, these new theories of harm raise issues with respect to remedies that are worth considering further. Historically, the TCA has been reluctant to take a stand on data protection issues and considered data protection law as separate from competition law, despite the necessity of handling it in a similar fashion. Even though there have been cases or investigations where the TCA recognized the importance of data as a competition parameter, there have, so far, been no cases dealing with privacy-related concerns.
TCA’s decision was therefore highly significant for many reasons, including the surprising move by Turkey to fight back against Facebook. This decision can be interpreted as a response to the outrage expressed by the public in Turkey, who perceived it as a discriminatory practice.
TCA’s quick response to WhatsApp’s excessive data collection and unfair trade practices, and the issuance of an interim measure to stop data sharing between WhatsApp and other Facebook companies, is a considerable victory for the protection of personal data in Turkey. It may indicate the TCA’s intention in the future to take a more interventionist stance on consumer exploitation that hinders competition in the online advertising market or otherwise negatively impacts competition and innovation by altering the dynamics of what should be fair competition.
A day after the TCA’s interim measure, the Turkish Personal Data Protection Authority (PDPA) initiated an investigation into WhatsApp’s policy update. The PDPA investigation deals with WhatsApp’s 2021 updates of privacy policy and cross-border transfer of personal data to third-party data. Article 9 of the Turkish personal data protection law requires explicit and informed consent for data transfers to foreign countries, where certain appropriate safeguards are not provided, or an adequacy decision has not been issued by the PDPA. The PDPA also inquired whether conditioning the use of WhatsApp on consenting to the transfer of data to foreign third-party controllers violates the data protection principles of “lawful and fair processing”, “processing for specified, explicit, and legitimate purposes”, and “processing that is adequate, relevant and limited to what is necessary”, enshrined in Article 4 of the personal data protection law. In September 2021, PDPA fined WhatsApp USD 235,000 for infringing the explicit consent requirement and principles of “processing for specific, clear and legitimate purposes” and “being connected, limited and restrained to the purpose for which they were processed”. Turkish data protection law generally provides for more limited and fewer deterrent remedies than competition law. To Facebook, USD 235,000 is nothing more than a cost of doing business, and it is hardly a deterrent to privacy-violating behavior.
It is thus important that Turkish regulators didn’t only opt for data protection investigation, where a breach of the law could be proved without going through the complex process of relevant market definition and market power. Data protection laws oftentimes fail to tackle market failure. Compared to data protection law, competition law provides the most deterrent remedy in this given case. Besides higher fines, it also offers behavioral remedies to tackle forms of privacy degradation, unilaterally imposed by online platforms. Behavioral commitments for the dominant online platform can create a regulatory asymmetry that could foster competition in the market: Imposing tougher conditions on dominant firms would favor the entry of new players into the market. It is, therefore, crucial, to apply competition law measures alongside data protection laws in certain instances to enhance the effectiveness of the data protection law.
Conclusion
For many years, competition experts argued that privacy is a consumer protection issue rather than a competition problem. This view is an incomplete account of the interface between competition, consumer protection, and privacy.
The non-financial nature of data tends to strongly exclude platforms from the definition of “relevant market” adopted by competition law. However, in digital markets, competition is not only about price, but also about quality, choice, and innovation. In fact, Facebook’s business models have been built around supposedly zero-price services to monetize other tied markets such as advertising. It therefore, does not make much sense to focus a competitive assessment on prices, as these have been free by choice.
Quality, however, will often be the relevant locus of competition. Lack of competition, in many markets, will lead to higher prices and reduced quality. In the context of “zero” prices, the reduction in quality due to monopolization can become even more pronounced. A reduction in consumer data protection and consumer privacy is precisely a fitting example of such a reduction in quality.
For many years, competition experts argued that privacy is a consumer protection issue rather than a competition problem. This view is an incomplete account of the interface between competition, consumer protection, and privacy.
The controversy regarding the intersection of competition law with the protection of privacy, following the emergence of big data and social media, is a major challenge for competition authorities worldwide. The Turkish decision sets a precedent for regulators around the world who are scrutinizing online platforms. Facebook’s market power is generated as a large volume of WhatsApp user data, after being collected and processed, is shared with the bigger platforms. This makes it difficult, if not impossible, for any competitor wishing to enter the market to offer alternative or, in any case, truly competitive services.
We learned by experience that it was a grave mistake that privacy concerns have not played a role in merger decisions or antitrust analysis. WhatsApp was founded as a privacy-conscious company. It offered consumers substantially better privacy protection than Facebook did at the time. Facebook acquired WhatsApp and reduced the privacy options available to consumers in the market post-merger. Subsequently, two billion WhatsApp users around the world have missed out on the benefits that competition could have had on their privacy.
Competition, consumer, and data protection laws share a number of “family ties”. These ties are particularly evident in the data economy. Competition can emerge over privacy, complemented by meaningful data protection.
