Apple/Shazam: Data Is Power, But Not A Problem Here

December 2018

CPI EU News Column edited by Thibault Schrepel, Sam Sadden & Jan Roth (CPI) presents:

Apple/Shazam: Data Is Power, But Not A Problem Here By Nicolo Zingales (Sussex Law School)¹

Introduction

Is there a significant impediment to effective competition where a major provider of music streaming services acquires a leading application for automatic music recognition, particularly insofar as the latter enables the identification and targeting of users of competing streaming apps? In Apple/Shazam,² the European Commission answered this question in the negative, considering several ways in which the data collected through that application could lead to a competitive advantage. The Decision constitutes an important addition to the series of EU merger cases involving the use of customers’ personal data,³ as distinct from broader “big data” concerns.⁴

Facts

On March 14, 2018, the Commission received the notification of a concentration that would result in Apple’s acquisition of Shazam, a developer and distributor of music recognition apps for smartphones, tablets, and personal computers. The notification followed a referral pursuant to a request made on December 21, 2017 by the Austrian competition authority, to whom the acquisition was notified on December 12, 2017; competition authorities of seven more EEA Member States subsequently joined the request. On April 23, 2018, the Commission opened a Phase II investigation due to two distinct non-horizontal and non-coordinated effects:⁵ (a) the potential foreclosure of competing providers of automatic content recognition (“ACR”) software solutions as a result of conduct such as pre-installing Shazam on iOS, integrating Shazam with iOS, or degrading the interoperability of ACR solutions provided by Shazam’s competitors on iOS; and (b) the potential foreclosure of competing providers of digital music streaming apps as a result of Apple gaining access to commercially sensitive information on its rivals through the Concentration.

However, having conducted an in-depth investigation on the databases maintained by Apple Music, Apple Music’s competitors, and Shazam’s competitors and having examined several possible concerns arising from the concentration, the Commission concluded in its Decision on September 6, 2018 that the Transaction would not significantly impede effective competition in any of the following: (i) the licensing of music charts data at worldwide level, in the EEA or in any of the Referring States; (ii) online advertising services in any of the Referring States; (iii) digital music streaming apps in the EEA or in any of the Referring States; and (iv) ACR software solutions at worldwide level or in the EEA.

The Decision

The Decision takes a close look at the digital music industry, including digital music streaming services and ACR software solutions, and the role played by user data in generating insights, product development, and targeted advertising. It identifies five distinct relevant markets: (1) software solution platforms; (2) digital music distribution services; (3) ACR software solutions, including music recognition apps; (4) licensing of music data; and (5) online advertising.⁶ The Commission left open the possibility of further market segmentation, as there would be no impediment of effective competition under any of the plausible definitions. Nevertheless, what appears clear from the competitive assessment of these markets is that Apple has a considerable share (20-30 percent) both in software solution platforms and digital streaming apps; while Shazam has a prominent share (in excess of 30 percent) in the market for music recognition apps for smart mobile devices, and a more marginal position in the market for ACR software solutions (5-10 percent). Finally, although the investigation was inconclusive with regard to the market shares of the parties in the markets for licensing of music charts data and online advertising, the Commission confirmed in its investigation the existence of multiple alternative providers.⁷ That finding, along with the complementarity of the parties’ datasets, led to the conclusion that the merger would not give rise to horizontal effects.⁸

With regard to non-horizontal effects, the Commission considered potential foreclosure of competing providers of digital music streaming apps due to the acquisition of commercially sensitive information, compounded by two possible groups of practices that Apple could undertake post-Transaction, that is denial or degradation of access of Apple Music’s rivals to: (i) Shazam’s referral mechanism as a customer acquisition channel; (ii) Shazam’s referral mechanism as a functionality that boosts user engagement and enriches user experience; (iii) Shazam as an advertising tool; (iv) Shazam as a provider of in-app music recognition functionalities; (v) Shazam’s User Data as an input to improve existing functionalities, or offering additional functionalities, on music streaming services.

Thus, the first and main theory of harm reviewed by the Decision concerns the possibility that Apple would take advantage post-transaction of the information acquired by Shazam, including via its current API integration with Spotify, to derive commercially sensitive information. In particular, Apple could combine the Customer App Information (which includes information about the presence of non-pre-installed digital music streaming apps on the mobile device where Shazam is installed) with additional identifying information (such as email address, Facebook ID, mobile’s advertising ID, etc.) enabling it to draw up a list of customers of Apple Music’s and potentially target them with personalized offers. Here the Commission notes, “without prejudice to the assessment by competent data protection authorities” that such data aggregation seems to be permitted under the General Data Protection Regulation (“GDPR”), as Shazam’s terms of service “appear to inform” on the processing of the Customer Information processed by Shazam.⁹

Furthermore, Shazam is already able to access data about which apps are installed on a user’s Android device, because the Android Developer Guidelines allow all apps to do so. On the other hand, Spotify’s developer terms and conditions are quite stringent, imposing developers to: (i) only request from Spotify users the data they need to operate their app; (ii) not to email Spotify users without explicit consent; (iii) completely and accurately disclose the privacy practices and policies they apply on their app or website; and (iv) not use Spotify’s user data “in any manner to compete with Spotify.”¹⁰

Nevertheless, despite the existence of legal and contractual constraints on the use of Customer App Information, the Commission assessed whether the targeted advertising made possible by the combination of databases was likely to have negative impacts on effective competition, and concluded that it did not on three grounds.¹¹ First, the ability to access the Customer App Information on Android is not limited to Shazam and would not be limited to Apple post-Transaction (unlike for iOS). Second, the market investigation clearly indicated that the digital music streaming service market in the EEA (and in the Referring States, including Iceland where Apple Music is active) has been growing considerably, and that there are already several providers with the capability of targeting “music enthusiasts.” Third, the Commission noted that Apple has stated its plans to change Shazam’s data collection practices in order to bring them in line with Apple’s industry-leading positions on privacy and, thus, to update the Shazam app for OSs other than Apple’s OSs so that it will “not send to Apple the Customer App Information unless the music streaming service of that user agrees to allow this information to be sent to Apple.”¹²

The second theory of harm contemplated by the Decision is one of denial and degradation of access by competitors to Shazam’s referral mechanism as a customer acquisition tool. The Commission here determined that, even if the merged entity were to have the technical ability and the incentives to engage in such practices, it is unlikely that they would have the ability to foreclose competing providers of digital music streaming apps and adversely affect competition.¹³ This is because Shazam’s market shares have not translated into a significant degree of market power. And in fact, given the low number of referrals for registration currently coming from Shazam, the effects of denial or degradation of access of competing providers of digital music streaming apps to Shazam’s referral mechanism are unlikely to be sufficient to reduce their ability or incentives to compete.

A third and related theory considered by the Decision concerns the denial and degradation of competitors’ access to Shazam’s referral mechanism as a functionality boosting engagement and enriching experience. Here again, the Commission notes that the merged entity would lack the incentives to foreclose competition simply because of Shazam’s limited market power,¹⁴ and the limited relevance of referral mechanisms in competition between digital music streaming apps. The Commission notes that already pre-Transaction, the referral tile to Apple Music has a more prominent position on iOS devices (due to an existing partnership between the merging parties), which has failed to produce significant results in user engagement. And in any case, nothing would prevent users, post-transaction, from “shazaming” songs and listening to them on rival digital music streaming apps.¹⁵

A fourth and important theory of harm in the Decision explores the possible “big data” advantage arising from the acquisition of Shazam: Shazam’s data could be exploited to improve existing functionalities, or offer additional functionalities, on digital music streaming apps. Here, the Commission concludes that Shazam User Data does not appear to be unique and, thus, be able to confer a significant “data advantage” to Apple post-Transaction.¹⁶ The Commission’s assessment is based on an in-depth investigation of data available on users of digital music services using four relevant big data metrics: that is the variety of data composing the dataset; the speed at which the data are collected (velocity); the size of the data set (volume); and the economic relevance (value). In particular, it finds that Shazam’s data are not more comprehensive than other datasets available in the market, they are generated at a lower speed and with lower per user engagement, and have never been considered as a strategic asset by the merging parties.

A fifth theory of harm was that Shazam could be used to serve more effective ads, for instance through push notifications that promote Apple Music on Android devices. However, this theory was quickly dismissed on grounds that Shazam’s strength in the advertising market is relatively low; and that users always remain free to choose not to receive any of the notifications in question.¹⁷

Yet perhaps the most elaborate theory of harm examined by the Commission has to do with the possible foreclosure of competing providers of ACR software solutions, including music recognition apps, by the adoption of two different types of strategies: first, by providing different levels of integration of ACR functionalities between Apple Music apps and competing digital music streaming apps; second, by leveraging of Apple’s strong market position in other products or services, most notably in the hardware space.

The Commission rejects the first scenario, noting the existence of several alternative ACR providers, and endorsing the view gathered during the investigation that the concentration may have the positive effect of encouraging digital music distributors to partner with providers of ACR technology.¹⁸

As to the second scenario, the Commission acknowledges the theoretically possible impact on competition of the following three practices: (a) pre-installation of the Shazam app on Apple’s PCs, smart mobile devices, and other platforms; (b) deeper integration of Shazam’s app on Apple’s products and services; and (c) reduction of interoperability between Apple’s products and services (and, specifically, Apple devices’ microphone) and third parties ACR apps and software solution.¹⁹ However, it finds the concerns not to be merger-specific, as there is already a partnership and integration is in place between Apple Siri and Shazam’s ACR technology.²⁰

Furthermore, preventing hardware integration by competing ACR software solutions providers would be against Apple’s interest to have a multitude of apps in its ecosystem, ultimately affecting its competitiveness vis à vis other platforms.²¹ In any case, the Commission rules out any likely competitive impact of such integration in light of the fact that the parties do not have a sufficiently strong position in the market, respectively, for ACR software solutions platforms and ACR software solutions.²²

Author Opinion

This Decision offers food for thought to the ongoing discussion on the reform of competition law in a data-driven environment.²³ One takeaway is the difficulty of assessing market power in the presence of non-monetary pricing. The Commission also expresses discomfort in using market shares as a proxy for market power in fast-growing sectors characterized by frequent market entry and short innovation cycles,²⁴ while also noting that Shazam is not a startup company and there is no history of disruptive entry or innovation.²⁵ Absent from this discussion, however, is a hands-on examination of the ACR technology and business models, which could have arguably shed light on the relative quality of the products offered by competitors and the scope for entry.

First, the Decision only provides an introduction to the technology in question, distinguishing between fingerprinting and watermarking: in the former, quality depends on algorithms extracting recognizable data for audio signals and a large reference database, which is built upon the source fingerprints given by music labels and music streaming or download service providers and music aggregators. In the latter, quality depends on algorithms aimed at inserting data into the audio signal, and a smaller reference database that is likely to require closer cooperation with music publishers and record companies. While we are told that providers of ACR software solutions rely on both technologies, it appears difficult to assess the effects of the concentration without a clear picture of the relative importance of those algorithms and reference databases. This is disconcerting as ACR software solutions are destined to become crucial gatekeepers for the flow of information in the EU, particularly in light of recent legislative and policy proposals to require the adoption of on the installation of content recognition technologies to prevent the circulation of illegal content.

Second, a measurement of market power as the ability to reduce quality in this market can hardly overlook the significance of in-service advertising. This arguably implies the need for an assessment of the elasticity of demand in reaction to an increase in advertising, and of the frequency and intensity of advertising across providers of ACR software solutions. It is somewhat disappointing that, although the Commission perceives the existence of a problem with its estimation of market power, it fails to conduct the holistic inquiry that would enable it to reach more solid conclusions. This is all the more problematic considering that Shazam’s limited market power was a core reason for dismissal of the second, third, and sixth of the above-mentioned theories of harm.

Another aspect worth noting in this Decision is the interaction of competition and other policy goals. Specifically, one of the concerns that led the Commission to open a second phase investigation was inextricably linked to data protection law: would it be possible for Apple to use information collected through Shazam in order to identify customers of Apple Music’s rivals, and ultimately target them with advertising or marketing campaigns? While data protection law does not a priori prevent such targeting, the assessment in that context depends on the specific conditions of processing of personal data, including its transparency and the safeguards available to data subjects.

The Commission did not conduct such detailed assessment, however,²⁶ which could potentially mean that by approving a concentration that raises data protection concerns it failed to fulfill its duty to protect EU Charter rights. For this reason, a welcome development in connection with this Decision is the effort by the European Data Protection Board to initiate inter-institutional dialogue, through an unprecedented statement issued during the investigation calling for the consideration of the data protection and privacy interests of individuals where one or more companies have accumulated “significant informational power.”²⁷

In line with recent initiatives by the European Data Protection Supervisor,²⁸ the Statement goes beyond data protection: it demands the assessment of “longer-term implications for the protection of economic, data protection and consumer rights whenever a significant merger is proposed, particularly in technology sectors of the economy.”²⁹

Whether the European Commission and other competition authorities are indeed ready to take that challenge remains to be seen. In this regard, it is worth exploring the suggestion made in the Statement that such assessment be “separate to and independent from, or integrated into, the competitive analysis.” Should a digital rights impact assessment be one of the measures proposed in the reform package for competition law in the digital age? If so, what form should it take? Given the competition authorities’ lack of competence in making data protection determinations, this would arguably require the institutionalization of a dedicated cooperation mechanism between digital regulators.³⁰

Click here for a PDF version of the article

1 Nicolo Zingales is a Lecturer in competition and information law at Sussex Law School.

2 Case N. COMP/M.8788–Apple/Shazam, Commission decision of 6/9/2018, available at http://ec.europa.eu/competition/mergers/cases/decisions/m8788_1279_3.pdf.

3 See e.g. Case N. COMP/M.3440– EDP/ENI/GDP, Commission decision of 9/12/2004, available at http://ec.europa.eu/competition/mergers/cases/decisions/m3440_20041209_610_en.pdf; Case N. COMP/M.4731, Google/DoubleClick, Commission decision of 11/03/2008, available at http://ec.europa.eu/competition/mergers/cases/decisions/m4731_ 20080311_20682_en.pdf; Case N. COMP/M.6314–Telefónica UK/Vodafone UK/Everything Everywhere, Commission decision of 04.09.2012, available at http://ec.europa.eu/ competition/mergers/cases/decisions/m6314_20120904_20682_2898627_ EN.pdf; Case N. COMP/M.7217– Facebook/Whatsapp, Commission decision of 3/10/2014, available at http://ec.europa.eu/ competition/mergers/cases/decisions/m7217_20141003_20310_3962132_ EN.pdf.

4 Most notably: Case N. COMP/M.5232–WPP/TMS, Commission decision of 23/09/2008, available at http://ec. europa.eu/competition/mergers/cases/decisions/m5232_20080923_20212_ en.pdf; Case N. COMP/M. 4854–TomTom/TeleAtlas, Commission decision of 14/05/2008, available at http://ec.europa.eu/competition/mergers/cases/decisions/m4854_ 20080514_20682_en.pdf; Case N. COMP/M. 4942–Nokia/Navteq, Commission decision of 02/07/2008, available at http://ec.europa.eu/competition/mergers/cases/decisions/m4942_ 20080702_20682_en.pdf; Case N. COMP/M.5727– Microsoft/Yahoo! Search Business, Commission decision of 18/02/2010, available at http://ec.europa.eu/competition/mergers/cases/decisions/M5727_20100218_20310_ 261202_EN.pdf; Case N. COMP/M.8124– Microsoft/Linkedin, Commission decision of 6/12/2016 available at http://europa.eu/rapid/press- release_IP-16-4284_en.htm; Case N. COMP/M.8180– Verizon/Yahoo, Commission decision of 21/12/2016, available at http://europa.eu/rapid/ press-release_MEX-16-4491_en.htm; Case N. COMP/M.7813 – Sanofi/Google/DMI JV, Commission Decision of 23/2/2016, available at http://ec.europa.eu/competition/mergers/cases/decisions/m7813_479_2.pdf.

5 See European Commission Press Release IP/18/3505, available at http://europa.eu/rapid/press-release_IP-18-3505_en.htm.

6 Decision, paras 75-145.

7 Id. paras. 178-180 and 182-184.

8 Id. para 185.

9 Id. para. 231.

10 Id. para. 237.

11 Id. paras. 246-258.

12 Id. para. 245.

13 Id. para. 286.

14 This is supported by data that were not revealed in the publicly available non-confidential version of the Decision. See para. 291.

15 Id. para. 292.

16 Id. paras. 327-328.

17 Id. para. 305-306.

18 Id. paras. 310 and 344.

19 Id. para. 336.

20 Id. para. 342.

21 Id. para. 339.

22 Id. para. 347.

23 See the call for contributions by the European Commission (http://ec.europa.eu/competition/scp19/), the U.S. Federal Trade Commission  (https://www.ftc.gov/news-events/press-releases/2018/06/ftc-announces-hearings-competition-consumer-protection-21st); and the UK government (https://www.gov.uk/government/consultations/digital-competition-expert-panel-call-for-evidence).

24 Decision, para.162.

25 Id. paras. 163-164.

26 The analysis contained in the Decision in this respect is limited to noting “without prejudice of the assessment by the competent data protection authorities” that Shazam’s terms of service and privacy notice “appear to inform” on processing of the Customer Information collected by Shazam. See Decision, para. 231.

27 European Data Protection Board, “Statement of the EDPB on the data protection impacts of economic concentration,” available at https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_statement_economic_concentration_en.pdf.

28 See the initiatives listed at https://edps.europa.eu/data-protection/data-protection/reference-library/big-data-and-digital-clearing-house_en.

29 European Data Protection Board, Id.

30 See Nicolo Zingales, “Data Protection Considerations in EU Competition Law: Funnel or Straightjacket for Innovation?,” (June 30, 2016); P. Nihoul & P. Van Cleynenbreugel, The Role of Innovation in Competition Analysis, (Edward Elgar, 2018 Forthcoming), available at SSRN: https://ssrn.com/abstract=3158008 or http://dx.doi.org/10.2139/ssrn.3158008.