Antitrust, George Soros, Regional Sports and GDPR

So many things happened this week. To address all of them at once would require a novel, so here are some brief points:



Google has a variety of antitrust complaints pending and resolved against it in Europe, as discussed here. Others are being considered in the US. One case that had been resolved to a degree was the Comparison Shopping case in the EU, where Google was fined $2.7B but also - less discussed - was ordered to implement a compliance mechanism that would allow equal access by rival comparison shopping companies to the shopping placements in Google search. Earlier this week, 14 European comparison shopping companies filed a complaint to the EU antitrust commission alleging that Google's compliance is not actually compliance as intended by the EU, meaning Google would need to pay the punitive fine of 5% of global turnover backdated to the date of the original fine, and also on an ongoing basis until true compliance is implemented. The core of the objection is that 1) the auction-based system requires comparison shopping companies to effectively bid away their entire profit margins while Google can compete using simple internal accounting (they're not actually paying themselves), 2) Google still doesn't use relevance for comparison shopping in its organic ranking, 3) because this remedy created such a financial imbalance, Google had to create a veneer of compliance - meaning something that looked like true competition - because no comparison search sites were able to participate in this remedy version, 4) so it paid its other marketing partners to act as though they were comparison shopping companies participating in the auction - effectively recreating the original, prohibited Google Shopping experience. Also, unrelatedly DV360 had a bug that made it difficult for European buyers in particular to change campaigns or create new ones for Black Friday.


Companies that have bad news often release it on the evening right before a big holiday, e.g. Easter, Thanksgiving, Christmas, etc - because people will be distracted or out of the office. This is intended to mitigate the negative blow-back of whatever they have to release. For example, right before Easter in 2017, Facebook announced millions of fake accounts on its platform; right before Thanksgiving in 2017, Facebook announced a tool to see if you had been exposed to Russian ads; right before Christmas in 2017, Facebook announced a tool to see if you had been exposed to Russian propaganda; right before election day in 2018, Facebook announced its report on its involvement in Myanmar ethnic cleansing; and right before this Thanksgiving, Facebook released its memo on its involvement in the George Soros / Definers affair. This most recent in an increasingly unbelievably long series of embarrassments involved the company hiring a firm to proactively discredit George Soros via the very sorts of tactics recently highlighted by the NY Times. Increasingly negative sentiment towards the company and declining growth are compounding leadership issues at the company. And, of course, the company's ad platform went down just before Black Friday, leaving many advertisers unable to set campaigns live.


Amazon bid on the 22 regional sports networks that Disney is divesting from its 21st Century Fox acquisition. A number of large private equity firms also submitted bids, as did large regional broadcasters, including Tegna and Sinclair. Interestingly, New Fox did not submit a bid, though it still may in a follow-up round. This is not Amazon's first foray into sports, as it currently has streaming rights to Thursday Night Football, 20 English Premier League matches, as well as the US Open in the UK. Twitter previously had football streaming, beating out YouTube, Facebook and Amazon. YouTube owns streaming rights for Los Angeles's soccer team, and Facebook streams live sports including baseball - with 25 games that were exclusively available on Facebook (meaning not on TV) . But this is the first time Amazon, or any tech company, is bidding not for the streaming rights - but for the entire bundle of rights for something the scope of an entire set of regional sports (the closest may have been Facebook's bid for 5 years of Indian Premier League cricket - a bid that ultimately lost to Fox).  The networks are expected to fetch as much as $20B for Disney. One could imagine that Disney may not necessarily want to sell to Amazon, even if they're the top bidder, because one of Disney's unique selling points for its new streaming service is rumored to be live sports - and this would be less unique if Amazon had a similarly wide set of live sports on its own platform.

Amazon made another meaningful CTV move this week (technically the change went live late September, but it was only reported recently). The company now requires TV networks and digital publishers that publish content to any Fire TV connected devices to give Amazon rights to sell 30% of their ad inventory. Previously, publishers were able to sell their own ad inventory and take all the revenue, but Amazon published new terms of service that give Amazon additional ad inventory - and allow Amazon to keep all the revenue from this inventory. This matches the terms that Roku offers, but was a material change from Amazon's previous terms. Further, Amazon is requiring that in 2019, companies exclusively use Amazon's ad network to serve ads. Roku and Amazon blocking out third-party ad networks is among the several factors that led to Facebook recently shuttering its own CTV ad platform.


The CNIL, which is the French DPA, recently announced a decision regarding a small French company, Vectuary, that was in violation of GDPR. The heart of the decision was that Vectuary did not meet the requirements for informed consent under the GDPR and it would have to delete the relevant data it had gathered and change its consent practices (interestingly, it was not fined 4% of global turnover, as specified in the GDPR - I have yet to understand why). The bigger question is one of consent, how it is obtained and how it is transmitted. Industry observers are of two minds - either this decision invalidates the IAB's consent mechanism or it does not.

Vectuary is a location-based ad company that obtained geolocation data through a combination of an SDK and RTB bid requests. CNIL found that the consent management platform Vectuary created did not adequately provide users with identification of the relevant companies that would be processing the data (including Vectuary sometimes). The consent UI did not require an affirmative action indicating consent - sometimes users could take no action which would be interpreted as consent. Both are violations that are exacerbated by geolocation being among the most sensitive categories of data.

The open questions, however, are fairly nuanced - but the those nuances could have far-reaching implications. The UI Vectuary implemented did let users eventually see the relevant companies, but only after several clicks. One open question is what level of granularity and specificity is required on a single screen. The second question is about the reliability of the consent in the bid request - contractual relationships about having consent, alone, are insufficient to pass sensitive data. Rather assurances are required to ensure the upstream consent was obtained in an appropriate fashion - but what exactly satisfies the requirements here was not affirmatively established. Some extreme and somewhat biased interpretations of the fairly vague language CNIL used would render the existing IAB framework (which passes consent strings to downstring providers in a way where you can't, on an impression basis, confirm the veracity of each consent) unusable, though it remains to be seen what the actual intent of this CNIL decision is.