EU lawmakers pass strict new rules affecting big U.S. tech
bloomberg.com
bloomberg.com
Lawmakers voted to approve measures in the draft Digital Markets Act that could mean:
A company’s messaging or social media app is interoperable, to prevent users feeling forced to use one or the other because that’s where their friends are
A ban on behavioral targeting of ads to minors
Fines of as much as 20% of a company’s global annual sales for breaches for the law
Companies identified as “gatekeepers” and therefore set to be accountable under the DMA include Amazon, Facebook, Google, Microsoft, Apple and Booking.com, and could later hit online marketplaces Zalando and Alibaba.
-
Does this mean what I think it means? That we can finally say goodbye to half a dozen different chat apps and just have one (like Pidgin in the good old days)?
I'm not sure which messenger platforms even need to follow this requirement (e.g. is Signal big enough to have to open up?). Also, there's a few fun open questions like how to uphold end to end encryption or how to exclude spammy messaging services from the network.
Considering how first world governments are fighting against encryption I assume this is just a benefit to them.
Fun fact, I had an interoperable network between leading chat apps Messenger <-> Telegram <-> Viber <-> LINE back in 2017 on top of which we ran a privacy focused dating platform[1]. It was built using bot APIs of these platforms.
In fact, thinking about the exact wording, there might potentially be a loophole that would allow Messenger and WhatsApp to stay incompatible because they're different services by the same provider. But IANAL.
Still I'm skeptical that this draft would see it's light as a law as it is, iMessage is one of the main pillars of Apple ecosystem; Many in U.S. have told me that they must use iPhone as everyone is on iMessage there and I feel Apple will throw everything it has to prevent it being interoperable with WhatsApp in EU which has significant user-base there.
Am I wrong or is this revolutionary?
Not being able to split-test reliably for all users will also have a huge impact for the walled gardens.
Federation and bridge services are nothing new. Facebook's messenger used to allow XMPP clients years ago.
Now that at least the big platforms actually are mandated to provide open access for interoperability, maybe we can see some innovation in that field again.
The interesting thing will be stuff like feeds - how do you solve cross-platform activity feeds without creating massive privacy liabilities?
There's nothing preventing companies from setting up non-encrypted bridges to satisfy the interoperability requirements and just say "we can't encrypt there, it's not on us".
Latest case in point:
https://noyb.eu/en/irish-dpc-removes-noyb-gdpr-procedure-cri...
Until you've been in the position of filing a GDPR complaint yourself it's easy to imagine that GDPR enforcement is effective. That couldn't be further from the truth. Compliance officers (yes the people you're supposed to complain to) will do everything in their power to invalidate your claim and will then drag your complaint through enough Kafkaesque bureaucracy to make you throw your hands up in defeat.
I can only speak from my own experience but go ahead and filter by my own nation's (Denmark) successful fines of businesses. That list is paltry and full of fines that each amount to less than two months pay in most cases of a single employee.
I know that I tried to file a complaint in Romania back in 2019 and it was a huge hassle to do, with a large form with all types of info I didn't have easy access too (like the onus was on me to provide company information, contact details, etc). Whereas when I checked out the complaint form this year it only included a few fields, that made sense.
Aside from all that if I was one of the people handing out fines my thinking would be like this, first I would ramp up so start giving smaller fines, and then when people I was fining were not changing their behavior I would keep increasing the fines. If for example someone gave Arp Hansen Hotel Group A/S a significant percentage of its revenue as a fine the first time people would be up in arms and complain a lot, so then I give them a slap on the wrist of 147,800 euros - which in the average Dane's view would sound like a lot - and ramp up the next time to maybe 220000, then the next 400000 - and then if they keep on give them a million. At that point no matter what PR campaign is done to make them seem the victim it will be a hard sell, they were warned fined multiple small fines and never fixed up their act. Who can blame us?
At the same time I would also want to keep my view to what people were giving national and international bad actors in other countries, I would want my actions to look reasonable in relation to those.
Speaking of which I saw
Ireland: Fine against WhatsApp Ireland Ltd in the amount of EUR 225 million
The Irish DPA (DPC) has fined WhatsApp Ireland Ltd. EUR 225 million for breaches of the GDPR in relation to the provision of information and the transparency of that information to users and non-users of WhatsApp.
And
Luxembourg: Fine against Amazon Europe Core S.a r.l. in the amount of EUR 746,000,000 In its quarterly report, Amazon.com Inc. announced that the DPA from Luxembourg (CNPD) had fined Amazon Europe Core S.a r.l. EUR 746,000,000 for failing to process personal data in compliance with the GDPR.
These are also relative slaps on the wrist, but of course the problem for these companies with these fines is that just one fine might be a slap but 20 or so and you might start to get a welt on that wrist.
at any rate - I would not expect anyone to issue a fine of of 4% of annual global turnover – whichever is greater - the first two or three fines that are given out to any company - unless Facebook has some leak that shows them spelling out their plan to break the law and do what they want with EU citizen data because screw the EU!
>full of fines that each amount to less than two months pay in most cases of a single employee.
Aside from the municipalities / regions, I see two companies that had fines small enough to be possibly two months pay of a highly paid employee, the other ones sure maybe if we're talking at top management levels but that's sort of misleading. At any rate it's not two months of a janitor's wages - unless we're talking about the municipalities.
And for systematic non-compliance “structural or behavioural remedies”.
How they are going to deal with the practicalities of fighting spam remains to be seen.
> Companies identified as “gatekeepers” and therefore set to be accountable under the DMA include Amazon, Facebook, Google, Microsoft, Apple and Booking.com, and could later hit online marketplaces Zalando and Alibaba.
The EU is doing the real work to make the metaverse happen.
That's interesting - if it is harmful to minors, how it isn't when someone turns 18? I believe it should be banned across the board.
Same as for alcohol or tobacco, at some point society assumes you're mature enough to make your own decisions. Obviously it varies from individual to individual but we had to chose a date and in most countries it's between 16 and 21.
I agree that at some point it does start to feel like the EU is just souring the grapes they failed to grow themselves.
Why not invest in homegrown alternatives that bring the changes they want to see? Trying to mandate interop is I'm sure a dream for the .0001% of users who've been clamoring to get back on Pidgin...
But any meaningful amount of their revenue being fined for not providing that is ludicrous to me. It's just not withholding that kind of value from end users.
Any country is free to tax or ban any business as much as they see fit, in the best interest if their citizen that elected them. I really don't see your point here, even if this was a taxing attempt.
EU people don't distrust government as much as US does.
Why do you feel you have a right to judge their values and policies?
We are talking about democracies here. Specifically democracies where you cannot lobby with corporate money. If anything you should use this difference to monitor how much of your policies are shaped in the interest of lobbies vs citizens.
I mean let's start with the irrelevant anti-China ranting.. where did I say we should stop trading with Europe?! Did you just feel a need to shoehorn China into the conversation because they're the other major power in tech?
-
And then the weird commentary about why I feel I have a right to judge their policies...
You mean their policies as they affect American companies that dominate the space?
Forget that for a second even, as if I don't live in a country I can't have an opinion on their actions?
Like if you have something meaningful to say, try again, and maybe say something on topic.
And maybe learn more about the institutions you're talking about: https://www.europarl.europa.eu/at-your-service/en/transparen...
"Specifically democracies where you cannot lobby with corporate money"
Because these user-hostile practices give the companies who employ them a competitive advantage, making it very difficult for better companies to compete.
Again, the vast majority of users will not take advantage of federation. If they had, Facebook wouldn't have been able to drop their XMPP support like it was nothing.
Despite the wants of the technical minority, it does not provide nearly as much value as these ultra specialized protocols do.
You see iPhone users declining to communicate with Android users over being forced to use the least common denominator.
They would rather not talk to someone than give up HQ pictures they'll look at for 5 seconds and forget.
Federation is a random stumbling block that at best will cement big players vs regulatory capture.
It's not going to make competition easier. Having an SMS to your competitor's iMessage is not going to make your iMessage competitor easier to launch.
-
And on a larger scale, the EU lost because they moved too slowly, acting like abusive practices is why Google ate search, Apple innovated themselves into their own kingdom, etc. is ridiculous.
Silicon Valley might slowly be losing its influence, and these companies do take actions that should be regulated (like targeted ads at minors) but Europe did not form its "Silicon Valley" fast enough. It fell behind in tech, and so now it stays behind in tech. The bad behavior is a sideshow compared to that.
Anti-competitive behavior isn't why they can't compete, trying to battle the resources and talent these companies with nowhere near equivalent footing is why they can't compete.
This is the internet, go back and look at the reactions yourself.
And XMPP will not let you fight with Facebook's network effects.
Point to one major competitor to Facebook that was taking advantage of XMPP to reach even 10% of their billions of users in 2015?
XMPP is a bloated mess that would struggle to support half of what Messenger does, so you'd just get another iMessage vs SMS deal.
-
Honestly it's bizarre how people think large companies work. Like someone sat down and said "let's rewrite our chat backend to kick off Pidgin and the other smattering of clients that use XMPP!
Realistically XMPP was limiting, so they wrote a rich platform with MQTT, and added an API to interact with the new platform.
It took years for XMPP to catch up to half of what Messenger was doing.
Like these companies do enough bad stuff, can we stop inventing new things?
Except that there isn't an API for the new platform. Not one that allows interaction even by a client that is willing to code specifically to a proprietary API.
I don't think forcing companies to use a specific api (e.g. XMPP) is a good idea. But forcing them to expose functionality over a stable, documented, versioned API probably is.
https://developers.facebook.com/docs/messenger-platform/
Maybe it doesn't do what you want it to (personal use 3rd party client?), but again, we get back to exactly what the reality was back when XMPP was around...
Literally no one was ever able to even come close to leveraging XMPP to counter Facebook's network effect. And the vast majority of interactions happened by clicking the little message icon in a Facebook property.
Like even officially recommending companies do so, I would not have a problem with.
But to me it's simple, a punishment should be at least somewhat proportional to the damage + some punitive multiplier.
The damage of not having something like XMPP is nearly 0. You multiply it and it should still be nearly 0.
-
More than that, again, has a terrible smell of not actually about being the stated goal, but rather trying to ride the wave of an industry you fell behind in.
And to that I say, catch up instead. People come up with all sorts of excuses... China sure is competing. Even India is competing locally with outsiders.
Europe simply has not made comparable the investments or efforts to other parts of the world to throw in the towel and claim "big bad FAANG can never be out competed unless we kneecap them"
I still want my government not to ignore abuses of foreign companies. I could make say a competitor to say Google or Apple messenger but to have a mobile application I need to first get approved by Apple and Google in their store, get access to same APIs. Then on top of that if I make a cool paid messenger app Apple and Google would tax me while their offer their shitty messengers for free because they abuse their dominance in a merket to compete in a different one.
You know free market theory has some axioms, some of them are about competition and free markets(no monopolies or duopolies/cartels or same economic agent competing in many different markets using the dominance from A to screw competition in B) -> free market works IF and ONLY IF there is actually a free market.
Checking abuses, sure, go for it.
Arbitrarily setting up rules to collect a toll instead of just getting your car in the race, no.
American companies shouldn't allow it, the American government should exert pressure when possible to avoid it.
Even banning the services is better than that, at least there's some internal consistency to there. You don't get to start pissing in the pot because you don't have a plate.
The same way I can move my phone number I should be able to change my IM client, if you are a US company that does not care about us poor EU citizens then feel free to go away.
Conclusion, if even in my local country we the citizens vote some people and demand of them to stop the giant tech to screw us over then you either respect it or go away, but you have your right to complain and I have the right to tell you that you are missing the point.
About competing, as I said before, I was thinking to start a open free music platform , where muysicians can sell their stuff without 0 parasites sucking the profits, but I can't do that because of Apple and Google that will always suck 30% from the creators and this profits will go to enrich some billionaires in countries that do not respect human rights, kill journalists and do other crimes. I can't implement my dream because of unfair competition.
Let me address the only on-topic words mentioned:
> demand of them to stop the giant tech to screw us over
A lack of federation is not screwing people over. End of discussion full stop. If you want me to elaborate, feel free to read the hundreds of words above where I do, it's simply not screwing people over to not offer a largely unused and ignored interface to your product.
I don't care if countries want to put a stop to the _actual_ problems arising from tech, inventing new ones is a no go.
-
Also this is a game of chicken that's hilarious to me... your country can always block these tech companies. If it's just as simple as "respect it or go away", well obviously they're out of line already... so block them?
They don't get blocked because the citizens of these countries need them. If Europe had invested in tech as heavily as China they could block them too.
But they didn't... so now it's not quite as simple as "do as we say or go".
But we will see if Apple, Google ,Facebook will leave EU or will try to screw us over but in a different way.
Well since we implemented the unsubscribe things are looking shaky for FAANG, but not to worry, such wonderfully open and free regimes such as Russia and China will be happy to take over co-parenting the EU with Germany.
I'm not an expert on EU legislation, but as I understand it, a commission (i.e. subset of the members) of the European Parliament (directly elected by EU citizens) voted on what they want their position to be when they, as representatives of the wider Parliament, negotiate with the European Council (leaders of the EU member state governments) on what the Digital Markets Act should end up looking like. Before that, however, the wider Parliament will also need to vote on that, which will happen half December.
(And as for how the other big EU institution, the European Commission (which functions like the government, and has a representative of each member country chosen by that country's government), is involved, I think they were the one to originally propose the Digital Markets Act?)
Source: general vague knowledge, and this tweet by a member of the negotiating commission: https://twitter.com/kimvsparrentak/status/146308360186886963... Corrections welcome.
You're right the DMA isn't law yet, it's only party-way through second step of the process, the Ordinary Legislative Procedure.
The Ordinary legislative Procedure works something like this:
1. The Commission adopts a Proposal for a legislative act (i.e. a Directive or Regulation)
2. The European Parliament considers the proposal in committees (with a nominated lead committee), and then in plenary. This will almost certainly involve amending the text of the proposal.
3. If approved by the European Parliament, the proposal then moves to the Council of the European Union (not to be confused with the European Council, mentioned above, or the Council of Europe, which is not an EU body.[2]). This Council is made up of representatives (often ministers) from each of the member states, but not the heads of state and government.
4. If the Council has suggested amendments to the text then these can either be accepted by the European Parliament or a process known as "trialogue" happens, where there are negotiations between Parliament, Council and Commission.
5. Once the institutions have agreed on the final text, the act is published in the Official Journal of the European Union and becomes law.
[0] The body comprising the heads of state and government of the EU's member states
[1] But only after Parliament holds confirmation hearings. These can - and have - led to portfolios being re-assigned or to member states withdrawing their candidates and replacing them with somebody more acceptable to Parliament.
[2] Somebody really needs to do something about these names as it's confusing AF. Although generally the Council of the European Union is referred to as just "the Council".
Also, I'd point out that there's still a step 6: once the law has been adopted by the EU, it doesn't come into effect until the countries have incorporated into their own laws, for which I think they have two years?
For Directives, yes. However Regulations don't need domestic legislation to take effect, the exact same text is law across the whole of the EU (and often the EEA) as soon as it comes in to effect.
Although once the act has been published in the OJ it is law, irrespective of the type of law. It's just that Directives are addressed to (bind) Member States rather than the population as a whole, thus domestic legislation enacted by the member states is required to bring about the legal effects required in the Directive.
I mean, I'm not sure that _helps_.
But it's a good rule of thumb that unless the full name is used then "[the] Council" means "the Council of the European Union" rather than any of the others.
Maybe it's just me who finds that useful...
If there no longer a competitive advantage in having a differentiated platform in the EU, then let others spend the resources on that service.
I use it.
"So, for the different apps to be interoperable, no encryption is allowed"
Again, I would prefer the market to sort it out without interference from politicians.