Thread by @mikarv

Digital Markets Act Thread

Core to the DMA is the idea of "core platform services" and providers thereof, listed here and defined either within the reg or in previous regs. Big and powerful providers of these are in scope, basically.

The juicy parts of the DMA are Articles 5 and 6. These contain obligations for gatekeepers in relation to core services. Art 6 obligations can be further specified by the EC through implementing acts.

Art 5: platforms must
- silo data relating to core services
- not forbid businesses from using other intermediaries too
- allow businesses to contract with users outside the platform but fulfil contracts through the platform (i.e. stopping the Apple App Store tax)

- not forbid businesses from dobbing them in to law enforcement
- not force businesses to use a particular ID service (may interact with the DSA's KYC requirements?)
- not bundle their core services together and force you to sign up to 2+

AND interestingly for ads
- provide advertisers and publishers with the price/remuneration deets (to stop intermediaries controlling market visibility).

Now, art 6, which can be further specified with implementing acts...

The Art 6 requirements are a little less self explanatory. Implementing Acts mean both that they can be strengthened over time, but also give lobbyists something to fight to weaken the instrument with at a later date.

Many of these Art 6 requirements will likely in practice be linked to convoluted processes of standardisation which have never been good at resisting industry capture.

Platforms must
- not use data of their business users to compete with them.

Classic Amazon clause, common complaint and concern all over the world. Pretty self-explanatory start.

- Allow end users to uninstall preinstalled software unless it is technically essential and cannot be offered standalone.

This hits at things like Google Play Services, and is likely to set up fights about what is technically essential or not.

Interesting this para starts with 'core platform service' but ends with 'operating system' as exception. How do you "uninstall" from a cloud service? As written, sort of implies you can, which is an interesting concept (uninstall a/b testing?). also e.g. Facebook apps of old...

Here's a biggie.
- allow installation and effective use of 3rd party software/app store using and interoperating with an OS, and allow their access by means other than through a core platform service.

The exemption to this is that gatekeepers can take proportionate measures to keep their OSs secure. This is clearly aimed at App Stores. It asks a whole range of things: what about access to APIs in the OS? What are these proportionate measures?

This provision would remove the "soft law" that App Store policies wield. Hooray for open software! But also will affect App Stores as regulating apps with trackers in, for example. Or App Stores forbidding pornographic apps. Lots to parse here. Expect Apple to sue.

Actually, expect Apple to do nothing, and someone to eventually sue, but the whole thing to turn into a mess because replacing the current system needs a clear vision of what follows, and requires deep OS changes too.

- not rank their own products better than others'. Similar to issues in the B2B platforms regulation. Straightforward most of the time.

- refrain from technically restricting the ability of end users to switch between and subscribe to different apps/services to be accessed using the OS, including internet access.

This one is pretty open ended.

It has flavours of net neutrality — sorry, Open Internet — bundling of hardware by a cell provider for example. It may also be speaking to things like telling Siri to use Spotify rather than Apple music. Interoperability vibes within an OS. Wide scope for implementing acts.

If anyone has more insight into that provision and exactly what or who it is aiming at, you should let me know...

- allow businesses, in the offering of 'ancillary services' to interoperate with OS, hardware and software.

Again, ancillary services is a HUGE definition (pictured). Aimed at payment, but would this provision prevent an iPhone limiting access to BT, NFC, UWB for non Apple apps?

Nearly there at the end of Art 6. Well, not quite but hang in there.

- provide advertisers and publishers with free analysis and vertification tools/information.

Another one aimed at the market failure of adtech, likely put in by publishers.

NOW THIS ONE
- provide effective data portability AND tools for end users to facilitate its exercise (normal, download your data tools exist) BUT INCLUDING by the provision of CONTINUOUS and REAL-TIME access.

This is bordering on interoperability, or one of its prerequisites.

There are weasel words in this provision, but not as many as there could be. The link between this and the GDPR is interesting, and an acknowledgement that data portability has failed.

A LOT of data falls within the scope of interoperability. A lot could then be accessed in real time. Expect this to be lobbied out, probably to be limited in scope. If not, expect huge non-compliance with it in its entirety.

- provide business users with real-time aggregated/non-aggregated data generated by end-users in their interaction with the platform. Personal data only when it relates to that business user's services and where consent is provided.

Basically, hit counters, demographics...

The consent barrier likely will mean few businesses will get personal data from this proposed provision. They also can't set up their own experiments so no a/b testing for them. Restricted by what platform collects.

Nothing here I see directly prevents e.g. Amazon from only a/b testing its own products and getting more data on that, apart from the data silo provision earlier.

Does Amazon have to treat its product sales team as if they were a business under this provision?

- if you're a search engine, provide other search engine providers on FRAND basis with "ranking, query, click and view data" that is anonymised (if it's query, click and view).

I can forsee an 'anonymisation' fight saying that Google Spain says this is all personal data... but I don't think that would stand in the way here. But this data is huge. Enormous. How often? How?

If a university set up a search engine, that would be a pretty nice dataset to get hold of. I'm a bit baffled about exactly what this dataset would look like in practice...

- apply FRAND terms to app store terms and conditions

I should probably note I've not read the recitals in full yet and there could be Interesting Clarifications in there.