30.8.2017   

EN

Official Journal of the European Union

C 286/6

1.

Facebook, Inc. (also referred to as ‘the Notifying Party’) is a provider of websites and applications for mobile devices (‘apps’) offering social networking, consumer communications and photo/video sharing functionalities. Facebook, Inc. also provides online advertising space. In particular, it offers the social networking platform, ‘Facebook’ (‘FB’), the consumer communications app, ‘Facebook Messenger’ (also referred to as ‘FBM’) and the photo and video-sharing platform, ‘Instagram’ (‘IG’). In the EEA, Facebook, Inc. operates via its wholly owned subsidiary Facebook Ireland Limited. Together, Facebook, Inc. and Facebook Ireland Limited are collectively hereinafter referred to as ‘Facebook’.

2.

WhatsApp Inc. is a provider of consumer communications services via the mobile app, ‘WhatsApp’ (‘WA’). It does not sell advertising space, or the user data which it collects. WhatsApp Inc. has been a subsidiary of the Notifying Party since 6 October 2014.

3.

The acquisition by the Notifying Party of sole control over WhatsApp Inc. within the meaning of Article 3(1)(b) of the Merger Regulation, which was reviewed by the Commission under case M.7217 — Facebook/WhatsApp and unconditionally cleared by decision of 3 October 2014, is hereinafter referred to as the ‘Transaction’. The Notifying Party and WhatsApp Inc. are jointly referred to as the ‘Parties’.

4.

Recital 5 of the Commission Regulation (EC) No 802/2004 (2) (‘the Implementing Regulation’) states that: ‘It is for the notifying parties to make a full and honest disclosure to the Commission of the facts and circumstances which are relevant for taking a decision on the notified concentration.’

5.

Article 3(1) of the Implementing Regulation provides that the notifications ‘shall be submitted in the manner prescribed by Form CO as set out in Annex I’ and Article 4(1) of that Regulation provides that the information contained in notifications ‘shall be correct and complete’. Annex I of the Implementing Regulation (Form CO) requires the following declaration to be signed by or on behalf of all the notifying parties: ‘The notifying party or parties declare that, to the best of their knowledge and belief, the information given in this notification is true, correct, and complete, that true and complete copies of documents required by Form CO have been supplied, that all estimates are identified as such and are their best estimates of the underlying facts, and that all the opinions expressed are sincere.’ (3)

6.

Pursuant to Article 14(1) of the Regulation (EC) No 139/2004 (‘the Merger Regulation’), the ‘Commission may by decision impose on the persons referred to in Article 3(1)b, undertakings or associations of undertakings, fines […] where, intentionally or negligently:

7.

Within this legal framework and on the basis of the evidence contained in the case file, the Commission considers that with respect to the possibility to automatically match FB user identities (‘IDs’) with WA users' mobile phone numbers, Facebook, Inc. has:

8.

Both before and after the notification related to case M.7217, the Commission asked questions to the Notifying Party in relation to the possibility to automatically match FB and WA accounts.

9.

Specifically, during the prenotification phase, the Commission raised the issue of whether ‘[p]ost-acquisition, [the Notifying Party was] planning to link/match in any way customers' profiles on WhatsApp with these customers' profiles on Facebook (e.g. by linking customers' mobile numbers from WhatsApp to these customers' Facebook accounts)’ (4).

10.

After the notification, during the Phase I investigation, the Commission received the paper by a third party complainant (the ‘Third Party Paper’). The Third Party Paper contained statements related to the possibility of Facebook aggregating user data between Facebook and WhatsApp using a ‘gateway’ between the Facebook and WhatsApp ‘platforms’ enabling cross-platform messaging, ‘without [the user] having to take any action’, or by ‘federating’ users' profiles with ‘a minimum user interaction required to grant Facebook access to the Whatsapp [sic] user ID (phone number)’. By the request for information (‘RFI’) of 18 September 2014, the Commission requested the Parties to ‘explain and substantiate whether [the Third Party Paper] accurately represent[ed] the technical ability (and incentive) of Facebook to integrate WhatsApp post-merger’ as well as to ‘provide any other comments [it] consider[ed] relevant’. (5)

11.

In the response to the RFI of 18 September 2014 (submitted on 23 September 2014), the Notifying Party stated that ‘[t]he matching [of WhatsApp and Facebook users] would need to be done manually, by the users themselves — Facebook users would have to enter, validate and update their mobile phone numbers or WhatsApp users would need to register with Facebook and create Facebook IDs and profiles.’ (6) Moreover, the Notifying Party stated that ‘The issue is whether Facebook knows the one thing about the user (other than name) that WhatsApp also knows – the user's current mobile phone number(s). Nothing else in a user's Facebook profile will enable matching, and WhatsApp stores very little user data beyond the mobile phone numbers in the user's handset's native address book. The Paper baldly asserts that “[t]heir [sic] is minimum user interaction required to grant Facebook access to the WhatsApp user ID”. This is simply not true. Because it is not possible to “match” Facebook IDs with each WhatsApp mobile phone number ID associated with the individual user on an automated basis, the matching would need to be done manually, by users’. (7) Similar statements were included in the notification form (‘Form CO’).

12.

At the time of submitting the Form CO and the response to the RFI of 18 September 2014, Facebook personnel were exploring ways to match IG and FB users. For this purpose, they were discussing the possibility to match users based on ‘Phone IDs’ and had already identified the ‘Phone ID Matching Solution’, which lies at the core of the user matching approach pursued by Facebook in connection with the update of WhatsApp's terms of service and privacy policy released in August 2016.

13.

However, the availability of the Phone ID Matching Solution in 2014, and particularly at the time of the review of the Transaction, differed according to the type OS at issue (that is, iOS v. Android OS).

14.

With respect to Android OS devices, at the time of submitting the Form CO and the response to the RFI of 18 September 2014, Facebook personnel had identified a mechanism to implement the Phone ID Matching Solution without having to change the applications' publisher.

15.

With regard to iOS devices, at the time of submitting the Form CO and the response to the RFI of 18 September 2014, Facebook personnel were aware of the possibility of implementing the Phone ID Matching Solution by changing the applications' publisher.

16.

Furthermore, although the efforts undertaken by Facebook personnel towards achieving user matching were specifically aimed at matching FB and IG accounts, the Phone ID Matching Solution and the mechanisms needed to implement it on the different OSs are potentially applicable to any application belonging to Facebook. Indeed, at the time of submitting the Form CO and the response to the RFI of 18 September 2014, Facebook personnel considered implementing the Phone ID Matching Solution to automatically match users across FB and WA once WhatsApp Inc. would be acquired by Facebook, Inc.

17.

In addition, while Facebook's efforts were specifically aimed at matching FB and IG accounts for de-duplicating purposes, the Phone ID Matching Solution and its implementing mechanisms can equally be used to match users across Facebook apps for other purposes (e.g. for advertising purposes), but not for the purposes of enabling cross-platform integration or messaging.

18.

The Commission considers that the information provided in the Form CO and in the response to the RFI of 18 September 2014 was incorrect or misleading within the meaning of Article 4(1) of the Implementing Regulation and Article 14(1) of the Merger Regulation. This is beause, despite the availability of these automated matching solutions, during the investigation related to case M.7217 Facebook, Inc. stated that user matching between FB and WA would either (i) have to be done manually by FB/WA users, and would therefore be insufficient and unreliable; or (ii) require Facebook to significantly re-engineer the apps' code.

19.

The Commission also considers that Facebook, Inc. acted at least negligently in supplying the incorrect and misleading information. Indeed, the Commission notes that at the time of the review of the Transaction and, in particular, when submitting the Form CO (on 29 August 2014) and the response to the RFI of 18 September 2014 (on 23 September 2014), Facebook, Inc. was aware or should have been aware that automated matching between a user's FB and WA accounts was or would have been possible. Moreover, Facebook, Inc. had been explicitly informed about the importance of supplying correct and not misleading information and warned about possible fines.

20.

Article 14(1) of the Merger Regulation states that, in case of intentional or negligent infringement of the procedural obligations provided for in the subparagraphs (a) to (f) ‘[t]he Commission may by decision impose on the persons referred to in Article 3(1)b, undertakings or associations of undertakings, fines not exceeding 1 % of the aggregate turnover of the undertaking or association of undertakings concerned within the meaning of Article 5’.

21.

As stated above, the Commission considers that Facebook, Inc. at least negligently supplied incorrect or misleading information in the Form CO in violation of Article 14(1)(a) of the Merger Regulation and Article 4(1) of the Implementing Regulation as well as in a response to an RFI pursuant to Article 11(2) of the Merger Regulation in violation of Article 14(1)(b) of the Merger Regulation. The Commission considers that these two submissions constitute two separate infringements of procedural obligations contained in the Merger Regulation and the Implementing Regulation, that those infringments are not time-barred, and that, therefore, fines should be imposed on Facebook, Inc. for these two infringements in accordance with Article 14(1)(a) and Article 14(1)(b) of the Merger Regulation. (8)

22.

As regards the determination of the appropriate level of the fines to be imposed on Facebook, Inc., according to Article 14(3) of the Merger Regulation ‘[i]n fixing the amount of the fine, regard shall be had to the nature, gravity and duration of the infringement’.

23.

As regards the nature of the infringments committed by Facebook, Inc., the Commission considers that they are of serious nature. A company's obligation to provide correct and non-misleading information in a merger investigation is essential for the Commission to review mergers effectively. Therefore, the provision of incorrect or misleading information in the Form CO or in replies to RFIs is in itself a serious infringement because it prevents the Commission from having information necessary for it to assess a transaction that has been notified to it.

24.

As regards the gravity of the two infringements committed by Facebook, Inc., the Commission considers that the incorrect or misleading information was supplied at least negligently. The Commission also notes that, albeit relevant, the incorrect or misleading information provided by Facebook did not have any impact on the outcome of the Commission's clearance decision in Case M.7217.

25.

As regards the duration of the infringements, the Commission considers that the provision of incorrect or misleading information is by nature an instantaneous infringement, which is committed in the very moment the incorrect or misleading information is supplied to the Commission. In this case, the Commission considers that Facebook, Inc. committed two infringements in two specific instances, namely on 29 August 2014 (when the Form CO was notified) and on 23 September 2014 (the date of the response to the RFI of 18 September 2014).

26.

In addition, the Commission considers that the cooperative behaviour showed by Facebook in the course of the current proceedings can be considered as a mitigating factor in the determination of the amount of the fines. In June 2016, Facebook proactively approached the Commission, and then it acknowledged the essence of the facts and the infringements of Article 4(1) of the Implementing Regulation and Article 14(1) of the Merger Regulation, allowing administrative efficiencies in these proceedings. The Commission has not identified aggravating circumstances.

27.

Finally, the Commission takes into account the need to ensure that fines have a sufficiently deterrent effect.

28.

In view of all that precedes, the Decision concludes that: