In February 2018, the European Commission issued a statement outlining the progress made by the three main social media platforms (Facebook, Twitter, and Google+) toward improving consumer protection, based on the requirements it made in March 2017. The EC found that Facebook and, to some extent, Twitter, still have work to do to fulfil the requirements. The EC’s strengthened approach to consumer protection in online platforms is a further example of the increased regulatory scrutiny on tech companies. It also shows how the rules of the countries where their users are will prevail over those of the company’s establishment, in line with the principles set out in the General Data Protection Regulation.
The EC has sought to enforce consumer protection rules on social media platforms for more than one year now
In a statement released on 15 February 2018, the EC recognised that social media companies are gradually adjusting to the European rules for consumer protection. However, it also noted this is too little and too late. The EC singled out Google as the company which made the most progress in satisfying requirements issued to all these companies in March 2017, off the back of an enforcement action launched in November 2016. All others have only partially addressed the requirements, and the EC is unhappy about the time it is taking to fulfil them.
The EC asked Facebook, Twitter, and Google to address concerns related to nine areas of activity. These also include: jurisdiction and applicable law (i.e. users’ ability to proceed legally in their own EU country); waiver of mandatory consumer rights (i.e. Facebook depriving users of the protections of EU consumer law); failure to identify commercial and sponsored communications; obligations on consumers to indemnify providers, and providers’ waiver of liabilities; and power to unilaterally terminate contracts.
Google+ is the most compliant, but its platform is also the least used of the three
In its statement, the EC praised Google+ for being the most compliant of the three platforms. Google+ was also the platform which caused the least concerns to start with, of the three scrutinised by the EC. However, Google’s social media platform should be the least important reference for the EC. Some unofficial estimates pointed to an “active user base” for Google+ of about 111m in 2015; however, users with more than 50 posts in total, and users with about 50 posts on the last 30 days, were around 7m and 3.5m, respectively. This paints a picture of a player whose relevance in the social media landscape has been in decline for a long time; as a result, its compliance with basic consumer protection rules has relatively little importance compared to the conduct of Twitter (which has about 330m monthly active users) and of Facebook (2.2bn monthly active users). While Google+’s compliance with the EC’s requirements is encouraging, it is also likely to be the least important for end users. The EC is now likely focus its attention on Facebook, which has more work to do to match the EC’s expectations and whose user base is by far the largest of the three platforms.
Online platforms will be increasingly asked to abide by the law of their users’ countries
The EC’s statement comes at a time when regulators are evidently raising their level of scrutiny and intervention toward online platforms. In the week commencing 12 February 2018, courts in Germany and in Belgium issued rulings against Facebook. In the former case, the social network was required to align its privacy policies with German law (although the upcoming General Data Protection Regulation will result in further changes to the social network’s privacy policy). In the latter case, a Belgian court ruled that Facebook cannot track users’ browsing activity outside the social media platform, and could face fines of up to €250,000 if it continues to do so.
While the business model adopted by these social media platforms is one whereby consumers do not pay money to use them, regulation is still seeing consumers as warranting protection. The EC’s decision to strengthen consumer protection, and the above mentioned court rulings, can be seen as extensions of the principle enshrined in the GDPR, which makes companies subject to the law of the end user’s country, rather than that of the country where the company is established. It is likely that this approach will apply to other areas of activity of online companies; this could also include taxation, which has caused debate related to where companies bill for their revenues, and is starting to cause a change in companies’ behaviour.
