Opinion

Europe must not rush Google-Fitbit deal

Merger would put highly sensitive health data of millions of Europeans at risk.

Francesca Bria is a professor at the Institute for Innovation and Public Purpose, UCL London; Cristina Caffarra is an antitrust and competition expert at Charles River Associates; Gregory Crawford is a professor at the University of Zurich; Wolfie Christl is technology and privacy expert at Cracked Labs; Tomaso Duso is a professor at Technical University and DIW Berlin; Johnny Ryan is chief policy officer at Brave; Tommaso Valletti is a professor at Imperial College London.

None of the authors is directly involved in the merger or has a personal financial interest in this matter (CRA, but not Cristina Caffarra, advises an interested party).

The European Commission appears poised to green-light Google’s planned acquisition of Fitbit, despite concerns from significant players in the field — including economists, privacy experts, health experts and consumer groups — that the deal warrants much greater scrutiny.

Approving the acquisition without a deeper investigation into its implications would not just be a serious setback for the EU’s competition policy; it would put the highly sensitive health data of millions of Europeans at risk.

After what is known as a “Phase 1” investigation, the Commission is now privately “market testing” a remedy from Google that it would hold separate and not use Fitbit’s user data (body data, health and fitness data) for advertising purposes for a period of five years (the terms of the remedy have been reported in the specialist press).

Typically, the Commission doesn’t test out a remedy unless it thinks it may pave the path to approval without further scrutiny. And yet the reaction among those canvassed — which include other wearable devices companies and parties involved in digital health — has reportedly been uniformly negative, with consumer groups calling as well for a more in-depth investigation before the deal is approved.

Ignoring these calls would set tech enforcement back a generation and send a clear signal that the Commission has not learned from the collective failure to police digital deals over the past decade. Regulators have been far too lenient in approving digital mergers and failed to spot acquisitions that have allowed entire industries to be monopolized: mergers such as Google-DoubleClick and Facebook-WhatsApp (the posterchild of unkept promises on data segregation) have had serious knock-on effects that regulators are now at a loss to undo.

Fitbit — which produces wearable devices that we strap to our bodies — is an attractive target for Google because it is a source of high-value personal health data. Digital health is a booming area — our data can be used to tell companies about our health and habits, to determine how we will be offered health services and insurance, and on what terms and by whom.

Fitbit is also attractive as a way to capture consumers’ attention. A wearable is essentially a minicomputer that people wear on their bodies around the clock. As such, it has unique access to our attention, turning us into sitting targets for exploitation, but importantly also protecting its dominance in search and data (just as it did with Android).

In the hands of Google — a company that generates enormous amounts of data on 2.5 billion people — the information provided by Fitbit will become enormously powerful. It would turn the health data of users into a proprietary fiefdom that — if it were available and accessible more widely — would otherwise have led to more competition and more innovation to the benefit of consumers.

The potential deal also has serious implications for privacy.

Data collection and (a lack of) privacy protection are at the very core of the business model of online digital platforms. This is particularly true of Google, which is uniquely able to track and link behavior across platforms, online services and websites to combine several datasets into “superprofiles” of individual users. Those abilities will be further enhanced with this acquisition.

Any promise to only use “aggregate” data would not mean much. There are different levels of potential aggregation and it is unclear what exactly Google could commit to. Besides, what matters is Google’s ability to link multiple pieces of information about individuals in a way that extracts relevant information quickly and on a large scale. For that to happen, Google doesn’t necessarily need to extract information about you personally; it’s enough for it to get that data from someone statistically similar to you.

The Commission shouldn’t fall for the predictable line that, as long as Google promises not to use Fitbit’s data for advertising purposes, and to keep them separate from its other data, everything will be fine and there will be no cause for concern. “Purpose limitation” is desirable but very hard to define and make tight.

It’s also important to note that undertakings not to “use” data — even if accompanied by the quaint promise to put in place a “monitoring trustee” — hold very little water. Companies make these promises time and time again, but they are, ultimately, unenforceable.

When the VP of Google Nest — which markets smart home products — stated that data collected from consumers would “never be used for ads personalization,” he was quickly corrected by a member of Google’s PR team and added, “We can never say never, but the commitment we are making is, it is not being used.”

It would be naive to believe the Commission is capable of preventing the misuse of consumers’ data. The asymmetry of information and the opportunities for mischief are simply too great. What Brussels can — and should — do is conduct an in-depth investigation into the potential acquisition, and explore all possibilities, hearing from privacy experts.

If this process is to be taken seriously, the consensus has to be that it is better to block abusive monopolies from taking root — rather than attempting to regulate them far too late.