A Matter of Choice: The German Federal Supreme Court’s Interim Decision in the Abuse-of-Dominance Proceedings Bundeskartellamt v. Facebook (Case KVR 69/19)

In June 2020, the Federal Supreme Court of Germany (Bundesgerichtshof) upheld the 2019 decision of the Federal Cartel Office (Bundeskartellamt) against Facebook during interim proceedings. It preliminarily confirmed that the latter abused its dominance on the (national) market for social networks for private users to the detriment of its users, overruling a preceding decision of the Düsseldorf Court of Appeal (Oberlandesgericht Düsseldorf). Facebook must, in a nutshell, stop collecting data about its users (and their terminal devices) without their consent when they are using apps and visiting websites outside the social network. The case is relevant from different perspectives. Firstly, it is set at the core of the debate on digital platforms providing services to consumers without demanding monetary compensation, but obtaining far-reaching access to their users’ personal data instead. This notion of ‘‘data as counter-performance’’ should be assessed with a view to the (yet to be implemented) Directive (EU) 2019/770 on certain aspects


Introduction
In June 2020, the Federal Supreme Court of Germany (Bundesgerichtshof) upheld the 2019 decision of the Federal Cartel Office (Bundeskartellamt) against Facebook during interim proceedings. 1 It preliminarily confirmed that the latter abused its dominance on the (national) market for social networks for private users to the detriment of its users, overruling a preceding decision of the Düsseldorf Court of Appeal (Oberlandesgericht Du¨sseldorf). 2 Facebook must, in a nutshell, stop collecting data about its users (and their terminal devices) without their consent when they are using apps and visiting websites outside the social network.
The case is relevant from different perspectives. Firstly, it is set at the core of the debate on digital platforms providing services to consumers without demanding monetary compensation, but obtaining far-reaching access to their users' personal data instead. This notion of ''data as counter-performance'' should be assessed with a view to the (yet to be implemented) Directive (EU) 2019/770 on certain aspects The author would like to extend his sincere thanks to Jure Globočnik and Moritz Sutterer for their most valuable help.
K. Wiedemann (&) Doctoral Student and Junior Research Fellow at the Max Planck Institute for Innovation and Competition, Munich, Germany e-mail: Klaus.Wiedemann@ip.mpg.de concerning contracts for the supply of digital content and digital services. 3 Secondly, the case sheds further light on the relationship of data protection legislation, most notably the General Data Protection Regulation (GDPR), 4 and competition law, as the Bundeskartellamt's line of argument was strongly based on Facebook's alleged non-compliance with the GDPR. Thirdly, to the surprise of many, the Court partially based its decision on the consideration that, for many users, Facebook acts as an essential forum by enabling them to exchange views and participate in public debates. Based on this finding it subsequently found (when balancing the interests concerned) that Facebook was indirectly bound by the human rights enshrined in the German constitution, even though it is a private entity. The long-term implications of this finding in areas other than competition law, for instance in the context of discriminatory advertising, can hardly be foreseen.

Previous Proceedings
In February 2019, the Bundeskartellamt issued a decision against Facebook based on Sec. 19 Competition Act, the national equivalent to Art. 102 Treaty on the Functioning of the European Union (TFEU). 5 It found that Facebook is dominant on the market for social networks and abused this position by using terms of service allowing it to collect personal data of its users (and data related to their terminal devices) outside the actual social network and assign these data to the individual user accounts. The decision prohibited use of these conditions and the corresponding data processing envisaged by Facebook. It only covered what the authority coined ''Off-Facebook'' data, i.e. those collected on websites and apps outside the social network. This includes services owned by Facebook (Instagram, WhatsApp etc.), but also third-party websites (such as online shops) that oftentimes do not even show any readily apparent connection to Facebook at all. The data is collected through so-called Facebook Business Tools, using various techniques such as plugins. Data collected while using the actual social network were coined ''On-Facebook'' data. The Bundeskartellamt essentially argued that the terms of service used do not provide any legal basis for the personal data processing under Art. 6(1) GDPR. According to the authority, the take-it-or-leave-it situation users were subjected to was abusive in that it made them lose control over their personal data and harmed competition. Facebook appealed the decision to the competent Düsseldorf Court of Appeal and applied to suspend execution of the decision until the main proceedings are over.
In August 2019, the Düsseldorf court granted interim relief to Facebook. Despite the cursory nature of the proceedings, the decision was highly detailed. It suspended the authority's decision based on several grounds, implying clearly that it would eventually be annulled in the main proceedings. Among other reasons, the Düsseldorf court found that Facebook's conduct did not result in any damage to competition, as users suffered no financial loss. It held that no causality was given between Facebook's market dominance and use of its terms of service, arguing that other companies were using similar conditions and the ''abusive'' terms of service were thus not deemed a result of market dominance. The court further argued that no exploitative abuse was given as users freely and willingly agreed to the terms of service and were free to abstain from using the social network altogether. It did not further elaborate on the alleged violation of GDPR requirements, arguing that this was not relevant for the case at hand.

Decision of the Federal Supreme Court
The Federal Supreme Court, still in interim proceedings, overruled the decision of the Düsseldorf court. Facebook must start implementing the decision, pending a final judgment in the main proceedings.

Theory of Harm: aufgedra¨ngte Leistungserweiterung
The Court chose a different approach to the case than the Bundeskartellamt did while still finding an exploitative abuse under Sec. 19 Competition Act. The decision does not put data protection issues at the forefront, but rather competition policy considerations. The theory of harm used is called ''aufgedra¨ngte Leistungserweiterung'', which can be roughly translated as ''imposed extension of services''. 6 Here, it is based on the differentiation made between ''On-Facebook'' and ''Off-Facebook'' data. According to the Court, this two-tier structure corresponds to two different levels of personalization of the ''user experience'', whereby the price to be paid (in the form of personal data) is higher when ''Off-Facebook'' data are also used. The Court argues that use of the social networkbrowsing it, connecting with friends etc. -is easily possible using ''On-Facebook'' data only, and that the processing of these data suffices for financing the service. Additional ''Off-Facebook'' data use provides for a more personalized user experience. Yet, it is not strictly necessary for providing the product Facebook's users are looking for.
The theory of harm is, in essence, that there is a significant number of users who would like to use Facebook without the higher degree of personalization (and the higher data price) that goes hand in hand with the processing of ''Off-Facebook'' data. But as they have no choice, they are forced to agree to the whole package, i.e.
'  In other words, the problem is that many users must use and ''pay'' for a service they do not want. The Court argues that in a competitive scenario, this outcome could not be expected: the market would cater for those users not willing to ''give away'' so much data and users would have a choice between more or less intensive data collection. 8 The Court sees damage to competition for two reasons: Firstly, users lack choice and are forced to supply more data than they wish to, having to use a product they do not want in its entirety. Secondly, Facebook's (potential) competitors are harmed as it becomes more and more difficult for them to compete for advertising contracts. Regarding the latter aspect, several factors come into play: Facebook benefits from direct network and lock-in effects. In addition, the higher quantity and quality of the data it is able to collect makes it more attractive for advertising companies.

Overview of the Court's Approach
The Court goes to great lengths in arguing that Facebook is dominant on the market for social networks, describing the well-known economic effects of multi-sided platforms. 9 It then presents its overall theory of harm in that Facebook abuses its market dominance by making all (private) users agree to terms of service that allow Facebook to collect ''Off-Facebook'' data and merge them with the user accounts without their further consent. 10 In the following, the main strands of argument will be summarized.
(a) The Court starts by contextualizing the economic role of the personal data provided by the users. 11 It argues that these data have a monetary value for Facebook, even though they are non-rival, non-exclusive etc., and must thus be treated as a counter-performance. The user data finance the social network and generate profit on the other side of the market, where Facebook sells advertising spots. Thus, there is a direct financial link between these two sides.
With an increasing quantity of data, Facebook becomes more and more attractive for advertisers, as users can be targeted more precisely and effectively. This assessment is based both on a competitive assessment and on the (not yet implemented) Directive (EU) 2019/770, which in its Art. 3(1) recognizes that personal data can be a counter-performance. a normative approach instead. 12 It argues that causality is given, as Facebook uses terms of service to the detriment of its users (who would, in a competitive scenario, profit from more available options) which, at the same time, also impedes competition in relation to its competitors. Thus, the Court applies the rather lenient causality requirements used on a European level in cases of exclusionary abuse 13 to an exploitative one. A decisive factor within this casespecific assessment is that the abusive conduct vis-à-vis the users triggers negative effects for competition on the market for online advertisements as well. The underlying idea is that, in such a situation, one must assess the overall effect on competition. Consequently, it does not matter if other, nonmarket-dominant companies would be factually able to impose the same terms of service on their users, as long as the damage to competition results from the market dominance of the company in question. (c) The Court further elaborates on why Facebook's conduct leads to an outcome deviating from the outcome to be expected in a competitive scenario. 14 The Bundeskartellamt conducted a survey, finding that a significant number of users would rather not provide ''Off-Facebook'' data. Many would even prefer a monetary payment option instead. The Court argues that in a competitive setting, Facebook would thus have an incentive to engage as many users as possible, as this would strengthen its position vis-à-vis advertising partners. The fact that Facebook does not provide a less ''data-intensive'' option indicates that it can act on the market irrespective of user preferences, which in turn implies an abuse of dominance. The Court addressed a rather obvious defence put forward by Facebook, which might well be used by other ''tech giants'' in other contexts: it claimed that the outcome was not anti-competitive, as other companies were relying on similar terms of service. Yet, the Court found that Facebook's market dominance is so strong that imitation of its terms of service by other companies is natural and does not allow any inferences to be drawn on what a competitive outcome would look like. 15 (d) The Court finds that Facebook's use of its terms of service impedes competition. 16 First of all, competitors are facing entry barriers to the market for social networks, as Facebook benefits from direct network effects on the user side: the more users it has, the more attractive it is for new ones. On top of that, competition is also impeded from a different point of view: the increasing amount and quality of the data Facebook has access to (a result partially due to its ''data hungry'' terms of service) may lead to anti-competitive effects on the market for online advertisements as well. (Potential) competitors who do not have access to data of this quantity and quality will face severe difficulties 12 Ibid., paras. 65-83. On the discussion about causality requirements, see Buiten (2020), pp. 9-12. 13 Cf. when it comes to selling online advertisements. This, in turn, makes it difficult to finance a social network. As a result, the entry barriers for (potential) competitors to the market for social networks are increased further. It does not matter whether Facebook is dominant on a (yet to be further defined) market for online advertisements on social networks as well, as the negative effects of its conduct do not necessarily have to occur on the market a company is dominant on. (e) A crucial part of the decision is the final balancing of all interests involved in the case at hand, based on the factual findings. 17 The Court sticks to the idea that competition is harmed both vertically and horizontally: vertically, a certain number of users must pay for an extended service they do not actually want, and, horizontally, competition is impeded on the advertising market.
With a view to those users who have to accept all of Facebook's conditions even though they would actually rather opt for the slim ''On-Facebook'' version, the Court confirms an exploitative abuse although it would be possible for the users to refrain from using the service altogether. 18 It elaborates that for many users, Facebook is an essential forum used to exchange views and opinions and participate in public debates. 19 Its role is strengthened by direct network effects and the particularly high number of users, which makes switching to another forum barely possible. bases under Art. 6 GDPR (such as consent and contractual necessity). For online communication and public discourse, Facebook plays an essential role, which makes it relevant in political, societal and economic terms. In order to safeguard the right to personal data protection, users must be protected from an overly far-reaching commercial exploitation of their personal data when communicating online. This holds true even though Facebook is a private entity, and thus not directly bound by human rights. Still, the Court finds, these constitutional values must be taken into consideration when interpreting general clauses of civil law, such as Sec. 19 Competition Act. It found that, as a result of this third-party effect, Facebook -providing a framework for public communication -may even be bound in the same way as public authorities are. The Court underlined that national and European law both play a role in this context. While the GDPR shapes the right to personal data protection (by, for instance, defining legal bases), national constitutional law should also be taken into consideration when assessing whether Facebook's terms of service are abusive. The Court did not decide whether agreement to the terms of service could be seen as valid consent under Arts. 6(1)(a) and 4(11) GDPR. (f) Eventually, the Court addresses Facebook's (unsuccessful) defence that user consent is not necessary, as other legal bases would apply anyway. 23 Readers will probably not be too surprised that the extensive data collection and processing in question is neither necessary for compliance with legal obligations 24 nor to protect the vital interests of its users (Art. 6(1)(c) and (d) GDPR). Also, Facebook failed to show that processing can be based on its legitimate interests (Art. 6(1)(f) GDPR).

Analysis
The Facebook case is relevant from three different viewpoints in particular.

Data as Counter-Performance
The Directive (EU) 2019/770 in its Art. 3(1) draws a fine line between the provision of data as counter-performance and data processing ''for the purpose of supplying the digital content or digital service''. 27 In the latter case, the Directive is not applicable, as the data processing is necessary anyway and does not provide commercial value for the trader. Facebook is a good example for showing that the differentiation between the data processing necessary for performance of the contract and the provision of data as a counter-performance can be cumbersome. For instance, to a certain extent, users have a vested interest in providing personal data in order to receive a good, personalized service. 28 A social network like Facebook only functions if users provide information about themselves, so it would be fair to argue that provision of one's name, date of birth, profile picture etc. per se would not be a counter-performance on the user side. Based on that, one might even argue that increased personalization based on as much data as possible might well be necessary to provide a truly personalized social network, finding that ''Off-Facebook'' data processing is also necessary for the purpose of supplying the service. The problem here is that these assessments eventually depend on how to interpret the contractual duties in a given case: what exactly can users demand from Facebook? Depending on the individual contractual duties, a legal basis can be found in Art. 6(1)(b) GDPR. To the extent contractual necessity is not given, user consent must be retrieved (Art. 6(1)(a) GDPR) 29 as long as no other legal basis applies, such as compliance with a legal obligation (Art. 6(1)(c) GDPR). It is not clear how to deal with a situation where one party to the contract -in particular a market-dominant one -unilaterally drafts terms of service in a way that purposefully increases the amount of data to be processed as a contractual necessity, simply in order to be able to invoke Art. 6(1)(b) GDPR. 30 In the case at hand, arguing that ''Off-Facebook'' data collection is necessary to fulfil the contract is not convincing, as Facebook does process those data not only for personalization in the sense of a better user experience, but also for another purpose users regularly do not aim for, namely advertising. 31 Thus, in casu, some of the data Facebook collects about its users must be considered a counter-performance. Still, it is difficult to define the tipping point between data as a contractual necessity and data as a counter-performance.
The need to conduct such differentiation is mirrored in the level of data protection law. Here, further complications are looming. When personal data are 27 The Directive is not applicable either when the data processing is conducted for the sole purpose of ''allowing the trader to comply with legal requirements'' (cf. Art. 6(1)(c) GDPR). 28 Cf. Drexl (2019), p. 37. 29 Art. 7(4) GDPR is relevant in deciding whether consent is ''freely given''. This will be discussed below. 30 Traders have an incentive to rely on contractual necessity, as the alternative (consent) is associated with several drawbacks. For instance, consent can always be withdrawn (Art. 7(3) GDPR) and must meet various requirements (cf. Art. 4(11) GDPR). 31 Cf. the wording of Art. 3(1) Directive (EU) 2019/770: ''(…) the trader does not process those data for any other purpose''. processed, the GDPR is applicable and the trader (here: Facebook) must find a suitable legal basis for the processing. 32 Article 6(1)(b) GDPR provides such a legal basis when the data processing is necessary for the performance of a contract. Yet, if the data are meant to (also) serve as a counter-performance, the trader is only allowed to process them if users have granted consent under Art. 6(1)(a) GDPR as the other legal bases contained in Art. 6(1) GDPR would not cover this purpose. Insofar, Art. 3(1) Directive (EU) 2019/770 and Art. 6(1)(a) and (b) GDPR can be applied in parallel, as both make it necessary to differentiate whether data processing is ''necessary'' to fulfil contractual duties or not. Hence, both layerscontract law and data protection law -should be seen as distinct, but at the same time intrinsically connected and interwoven. In the case at hand, it might indeed be argued that ''Off-Facebook'' data processing is only lawful under the GDPR if valid consent is given under Arts. 6(1)(a) and 4(11) GDPR, as the processing of ''Off-Facebook'' data arguably does not appear to be necessary to run the social network. Unconvincingly, Facebook tried to somehow invoke all legal bases under Art. 6(1) GDPR in its terms of service, with a particular emphasis on contractual necessity, consent and legitimate interests. 33 Regarding the above considerations, the debate on data as a counter-performance is particularly relevant with a view to market-dominant platforms in the digital economy providing seemingly ''free'' services. Unfortunately, due to its chosen theory of harm, the Court saw no reason to dig deeper into the relationship between contract and data protection law. Had Facebook been treated as an ''excessive pricing'' case instead, 34 then it would have provided a valuable opportunity to clarify some of the questions raised above, as the Court would have had to assess what the exact counter-performance on the user side is and why it is excessive.

Unequal Distribution of Power under Competition and Data Protection Law
The Court's decision obliging Facebook to give users a choice between more or less intensive data personalization is based on the notion of user autonomy. 35 The reasoning takes recourse to competition policy considerations, not to data protection law. Insofar, it diverges from the Bundeskartellamt's reasoning. The Court's dogmatic approach is convincing, taken that its decision is based on a breach of competition law: it puts the role of users as market participants at the forefront, not their role as data subjects. A closer look at the GDPR's regulation of consent -a legal basis based on user autonomy and choice itself -shows that not only competition law, but also data protection law aims at solving situations where an 32 Arts. 6(1) and 2(1) GDPR. 33 Cf. the Bundeskartellamt's decision, paras. 631-633, available at: www.bundeskartellamt.de/ SharedDocs/Entscheidung/EN/Entscheidungen/Missbrauchsaufsicht/2019/B6-22-16.pdf?__blob= publicationFile&v=5 (accessed 5 October 2020). 34 The Bundeskartellamt could have claimed that processing both ''On-'' and ''Off-Facebook'' data (based on Facebook's terms of service) would have been abusive, excessive pricing. Yet, this would have been difficult to argue on factual and legal grounds as, for instance, the authority would have had to define an adequate price for use of the social network (Buiten 2020, pp. 6-7). 35 On the role of autonomy in competition law, see Podszun (2019). unequal distribution of power between parties is given. The Court's decision can be seen as a welcome advancement of user autonomy also from a data protection perspective. By taking recourse to data protection legislation, such as the right to informational self-determination, legal basis requirements under the GDPR etc., the Court made clear that this legal regime played an indirect, yet significant part of the decision.
Basing its decision on the aufgedra¨ngte Leistungserweiterung theory of harm, the Court did not have to decide whether or not acceptance of Facebook's terms of service would fulfil the requirements on consent formulated in the GDPR. 36 This assessment would not only have been interesting regarding general questions of data protection law enforcement vis-à-vis online platforms, but also for the debate on data as counter-performance described above.
Assuming that Facebook demands consent to the processing of ''On-'' and ''Off-Facebook'' user data as a form of payment, then a key question from a data protection point of view would be whether this consent is ''freely given '' or not. 37 In this regard, Art. 7(4) GDPR is relevant. It reads: ''When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract (…) is conditional on consent to the processing of personal data that is not necessary for the performance of that contract''. Recital 43 GDPR goes on to state that consent ''is presumed not to be freely given (…) if the performance of a contract (…) is dependent on the consent despite such consent not being necessary for such performance''. This wording -postulating a general presumption -is problematic, as the Recital is significantly stricter than Art. 7(4) GDPR, which is part of the GDPR's binding provisions. Recital 43 GDPR refers to situations where there is a ''clear imbalance'' between the data subject and the data controller 38 ''and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation''. The Recital names consent given to public authorities as an example, thereby showing that it is its telos to protect data subjects/users in situations where one party has more power than the other one. There is no reason why this should not apply to imbalance in economic power, too. Thus, as a rule of thumb it is safe to assume that the GDPR's requirements on consent also aim at protecting the weaker party when the other one has significantly more power. A minori ad maius, this must hold true even more for market-dominant companies. Insofar, competition and data protection law share some common goals.
Yet, open questions remain regarding ''consent as counter-performance'' and when it is ''freely given'' or not. Several factors come into play. For instance, a general presumption that consent is always void in certain situations might be considered overly paternalistic and would be problematic with a view to Art. 8(2) Charter of Fundamental Rights of the European Union. As part of the right to the protection of personal data, reference is made therein to consent as a legal basis. 36 Facebook, as seen above, tried to invoke not only consent, but also all the other legal bases under the GDPR to justify its data processing. 37 Cf. Art. 4(11) GDPR, according to which consent must be ''freely given, specific, informed and unambiguous''. 38 I.e. the person or entity who determines the purposes and means of the personal data processing: Art. 4(7) GDPR. This in turn, arguably, grants users a constitutional guarantee to freely decide whether they would like to provide personal data in a specific situation. 39 This right cannot be restricted without good cause, as this would endanger the users' personal autonomy as well as the freedom of contract both parties -the users and Facebookcan rely on. A general presumption that in situations like the one at hand consent is void would fundamentally question whether consent to data processing can represent a contractual counter-performance in the first place. Such interpretation of Arts. 4(11), 7(4) and Recital 43 GDPR would run entirely counter to Directive (EU) 2019/770, which does recognize data as counter-performance, 40 and could significantly impede many business models of the data-driven economy. 41 The decision if consent is freely given and how to interpret Art. 7(4) GDPR thus ultimately depends on the individual case. During the assessment, one must ensure a fair balancing of the various interests at stake, protecting users who are dependent on certain services from granting ''consent'' that is not actually free while safeguarding their personal autonomy and freedom.
In casu, with Facebook being a market-dominant company and the Court's finding that it plays a major role for public discourse, there appears to be a strong case that consent was not freely given through acceptance of the terms of service. This finding is not based on (and does not question) the business model of Facebook per se, which is legitimate. 42 Yet, an obligation to offer a choice between ''Off-Facebook'' and ''On-Facebook'' data processing can indeed be based not only on Sec. 19 Competition Act (and, arguably, Art. 102 TFEU), but also on Arts. 4(11) and 7(4) GDPR. Insofar, Recital 43 GDPR seems to be tailored to the case at hand: ''Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case (…)''.
Overall, the two legal regimes can be applied coherently despite their different objectives (protection of competition v. protection of personal data) as both provide certain protection against an unjust imbalance of power. Yet, the relationship between data protection, consumer protection and competition law calls for further research, in particular when it comes to their scope of application and enforcement issues. 43 Besides, the starting point of the Court's theory of harm was that terms and conditions used by a market-dominant company can be an abuse of dominance. This leaves room to base other cases on breaches of data protection law contained therein, if an exploitation of users with relevance for the competitive process can be proven. 44

Human Rights Considerations
The Court argues that users depend on Facebook, finding that the social network is to some extent (indirectly) bound by the human rights provided in the German constitution. The reason is that Facebook provides a forum for communication which is essential for participation in public debates. The judgment (by the German Federal Constitutional Court) referred to by the Court deals with the question under what circumstances football clubs (running nationwide football stadiums and organizing matches) are allowed to ban individuals from entering these premises and watching the games. 45 The Constitutional Court found that the football clubsholding a quasi-monopoly over stadiums throughout Germany -must exercise their property rights having at least a certain degree of regard to the principle of equal treatment, even though as private entities they are not directly bound by the constitution. In a related decision, the German Federal Constitutional Court (during interim proceedings) hinted at Facebook's essential role for communication and public discourse as well, stressing how far-reaching its indirect human rights obligations possibly are regarding the principle of equal treatment. 46 The Court's reliance on constitutional law allowed it to consider during its balancing of interests both Facebook's role as a medium for public communication and the users' right to protection of their personal data. The future implications going beyond that remain to be seen. In a competition law context, they might, at least in theory, pave the way to applying or rethinking the essential facilities doctrine. 47 More importantly, regarding the selling of advertisements -Facebook's main source of income -the human rights dimension the Court presented might turn burdensome for the company. Presuming that Facebook is (indirectly) bound by human rights vis-à-vis its users, this means that it must not discriminate against them based on a protected ground. Private entities are in principle allowed to freely discriminate between users, as human rights -such as the principle of equal treatment -are directed at state bodies only. Private entities are merely bound by civil law anti-discrimination legislation, in particular those national laws implementing the EU non-discrimination directives. 48   fragmentary when compared to the obligations state bodies face under constitutional law. 49 In 2019, the United States Department of Housing and Urban Development charged Facebook with violation of the Fair Housing Act by encouraging, enabling, and causing housing discrimination through the company's advertising platform [alleging] that Facebook unlawfully discriminates based on race, color, national origin, religion, familial status, sex, and disability by restricting who can view housing-related ads on Facebook's platforms and across the internet. Further, [the Department] claims Facebook mines extensive data about its users and then uses those data to determine which of its users view housing-related ads based, in part, on these protected characteristics. 50 The more far-reaching Facebook's obligations of non-discrimination are, the easier it would be to prosecute similar charges of discriminatory advertising within the European Union.

Outlook
It remains to be seen how the case will eventually be decided. It is possible that the Düsseldorf Court of Appeal, the next instance in the main proceedings, will again decide in favour of Facebook, only to be overturned by the Federal Supreme Court again. Either court may even request a preliminary ruling under Art. 267 TFEU by the European Court of Justice (ECJ). This might concern questions relating to EU competition law 51 and/or to the GDPR. Guidance in this controversial field would be highly appreciated, as a European answer on how to deal with exploitative abuses conducted by international ''tech giants'' seems overdue.
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http:// creativecommons.org/licenses/by/4.0/.