CMA investigations underway in UK digital markets shake-up

Fiona:

Hello and welcome to Ashurst Legal Outlook. In this episode, we'll be diving into the latest investigations by the UK Competition and Markets Authority (the CMA) under the Digital Markets, Competition and Consumers Act 2024 (the DMCC Act). My name is Fiona Garside and I'm a Senior Expertise Lawyer in Ashurst's Antitrust, Regulatory and Trade team in London. I'm delighted to be joined today by two members of our London team, one of our counsel, Chris Eberhardt, and Issy Hunt, who's an associate in our team.

As a recap on the progress of the DMCC Act, it received Royal Assent in May 2024, and it introduces widespread changes to competition law and to the enforcement of consumer law in the UK, as well as the UK's new regime regulating designated digital companies. That's what we're going to focus on today: the developments under the new digital regime which came into force earlier this year on 1 January. As we touched on in an episode last summer, under the new digital regime, the CMA can designate companies as having "strategic market status", or SMS for short, and those designated companies will then be subject to enhanced regulation, including tailored codes of conduct and certain mandatory merger control reporting. The CMA also has the power to make pro-competitive interventions in relation to SMS firms.

In early 2024, the CMA's Digital Markets Unit indicated that it expected to start three to four SMS investigations in the first year of the new regime. While we're only a few months into 2025, we've already seen two investigations kick off involving three potential SMS firms, and the CMA has indicated that a third investigation will be started in the summer. We are already seeing significant activity under this new digital regime, and we'll get into those investigations a little bit later. But first, Issy, could you provide listeners with a reminder of how the investigations will work?

Issy:

Sure. The CMA can start an investigation if it has reasonable grounds to believe that it can designate a company as having SMS in relation to a digital activity, or areas of digital activity, that have a link to the UK. This will be where the CMA considers that a firm: (1) has substantial and entrenched market power; (2) is in a position of strategic significance; (3) exceeds specific group-wide turnover thresholds (being £25 billion globally or £1 billion in the UK) in the last 12 months, and this includes turnover derived from any non-digital activities; and (4) lastly that the firm engages in a digital activity that has a link to the UK.

In establishing these grounds, the CMA can use its own research, evidence gathered through its other work or information or recommendations from other regulators. In practice, the current investigations rely heavily on the CMA's findings in previous market investigation reports. The assessment will also be forward-looking over at least five years. For this, the CMA is essentially looking to see whether a company is able to behave independently of competitive forces.

As we've covered in a previous episode, the CMA's guidance notes that analytical tools used in dominance cases will be relevant here (for example, the company's share of supply), but that the CMA will not typically seek to draw on existing dominance case law because dominance cases are assessed in the context of a defined market, whereas the SMS assessment is focused on a digital activity, which is intended to be a more flexible concept. It will therefore be interesting to see what that looks like in practice once the CMA has carried out a number of these assessments.

Once the CMA starts an investigation, it will gather evidence through responses to invitations to comment, formal requests for information, consumer research surveys, and data analysis, with up to nine months to complete it before deciding whether to finalise the investigation.

Fiona:

Thanks, Issy. As you've mentioned, clearly the aim of this is to give the CMA more flexibility to intervene in a firm's activities and to encourage those competitive outcomes rather than dealing with conduct that it views as harmful after the fact. And Chris, in terms of designating a firm as having SMS, how does the CMA's approach differ when compared to the new digital regime in the EU?

Chris:

I think there are some important differences. For example, the CMA can't rely on presumptions when looking to designate firms as having SMS. As a reminder to listeners, under the EU equivalent (the Digital Markets Act), where the relevant criteria are met, there's a rebuttable presumption that the firm is a gatekeeper in respect of that core platform service. So where those criteria are met, the onus is then on the firm to show that it does not have gatekeeper status. Now, the approach in the UK is different: there aren't any thresholds which the CMA can rely on. There are requirements specified in the Act, but it has to establish those, go through the investigative process and take a decision to designate the firm.

Fiona:

Thanks for that context Chris. It's interesting to see the difference in approaches under the two regimes. Obviously, the EU regime is a few years ahead, and the first group of companies that were designated under the DMA have just published their second annual compliance reports. As expected, it looks like the CMA's first SMS investigations are targeting the same big tech companies that have been named as gatekeepers in the EU, albeit for now it's a smaller group of companies under the microscope in the UK. There's been growing political pressure on the CMA to ensure its activities are improving business confidence and facilitating growth. Can you comment on how that's expected to impact its new digital markets powers?

Chris:

Yeah, I think that's a really interesting question. In fact, the CEO of the CMA, Sarah Cardell, actually commented on this in a speech earlier in the month, in March, noting the importance of tech markets, but also explaining how the 4Ps framework might apply to the new digital markets competition regime. Now, for those who are not familiar with them, the 4Ps framework (which essentially refers to pace, predictability, proportionality and process) was first set out by Sarah Cardell at the end of last year. It really is now the general framework which the CMA is applying across all of its functions to seek to ensure their work complies with, and facilitates, the Government's overriding priority to achieve economic growth. Now, in the context of the digital markets regime specifically, let's think about how those apply in turn.

Firstly, pace. Well, the CMA has recognised that their work in digital markets really does need to keep up with the fast-moving and dynamic nature of those markets if they're going to avoid creating protracted uncertainty that could chill investment, innovation, and growth. There are obviously statutory timelines and processes that need to be followed in the Act, but Sarah Cardell has emphasised also that the CMA will need to move as quickly as possible: for example, by prioritising key areas of potential concern and, in her words, avoiding gold plating.

The second "P" - predictability. Now again here, there are parameters in the legislation which provide some predictability for firms (for example, in relation to the thresholds for designation or in terms of the types of conduct requirements) but a lot really will depend on how the CMA actually chooses to apply the new regime. I think it's recognised that it will need to provide further predictability, for example, through its guidance, through its stakeholder engagement, and through transparency around the timelines that it's adhering to.

Thirdly, proportionality. The CMA has noted that it plans to prioritise interventions which it thinks have a clear and direct impact for consumers and businesses. It says it will consider their strategic significance so looking at interventions which really do strongly support business investment and economic growth, but also that it will reflect on whether the CMA is actually best placed to act. And that includes how the CMA's actions may interplay with other regulators, be it domestically or internationally. Now on this, Sarah Cardell noted that it might make sense to replicate effective outcomes from other jurisdictions, which may suggest that the CMA is looking closely at the steps that have already been taken by SMS firms in respect to the Digital Markets Act in the EU.

And then the final P - process. On this, Sarah Cardell noted that the CMA plans to work constructively and collaboratively with stakeholders, and it has a wide range of consultation and engagement tools, and it will look to apply those at each stage of the investigation and we've seen some of that already.

I think we'll need to see how the framework and those principles really do play out and apply in practice. But I think it does show that the CMA is being careful to stress and show that it is listening to business to ensure that its interventions under this new regime are benefiting tech markets as well as the wider economy.

Fiona:

Thanks Chris. And against that background, Issy, should we move now to the CMA's first SMS designation investigation?

Issy:

Sure, no problem. As was expected, the first investigation was announced just two weeks after the new digital regime came into force in January. It is looking at Google's position in general search and search advertising services and follows the CMA's market study into online platforms and digital advertising which was published in 2020. As part of this investigation, the CMA is planning to look at the extent of competition between Google search and several other services including: (1) other general search services on both the user and advertiser sides; (2) specialised search services; and (3) other services such as artificial intelligence interfaces, for example, AI assistants or AI-powered search engines.

The CMA's media release also raised that Google accounts for more than 90% of all general search queries in the UK with over 200,000 UK advertisers using Google search advertising. I'd flag here the CMA's consideration of AI in this investigation. The idea is that this forward-looking perspective ensures that investigations remain relevant as technology evolves, and that is one of the key objectives of this regime. The ability to potentially include AI activities within the scope of the regime is another difference with the EU DMA.

The CMA will also consider potential barriers to entry and expansion for general search and search advertising services, as well as whether Google can extend its power in general search and search advertising to other activities and whether it can influence other firms' behaviour.

Chris:

Thanks Issy. So if we comment on the process now, as a first step in the investigation, the CMA issued an invitation to comment to Google and to third parties. Now, this set out the scope of its investigation, the basis of the potential concerns, as well as giving initial thoughts on proposals for potential conduct requirements. For example, it said those requirements could include requirements on Google to make the data it collects available to other businesses or to give publishers more control over how their data is used in Google's AI services.

That invitation to comment closed at the beginning of February and around 40 third parties fed into that process. They range from other digital firms to advertisers, industry bodies, research centres, as well as individuals, so there clearly has been a great deal of interest from third parties to participate in the process.

And looking at those comments, they're both supportive but also critical of the CMA's investigation, as well as flagging some industry-specific issues that the CMA had not raised directly. Now that the invitation to comment has closed, the CMA will be taking stock and is going to gather further evidence before it publishes its provisional decision, and then it'll propose conduct requirements later in the year. Following that, the CMA will gather final input from Google and third parties before it publishes its final decision by the statutory deadline of 13 October. We expect the initial conduct requirements to be finalised at the same time or shortly afterwards.

Fiona:

Thanks Chris, and that highlights that there is actually quite a lot of scope for third parties to feed into these kinds of investigations. This regime isn't only relevant to big tech companies. Issy, can you give us a quick overview of when third parties can get involved?

Issy:

Sure. As Chris noted, right at the start of an SMS investigation, the CMA will publish an invitation to comment. This will outline the main areas under investigation and the topics the CMA would like third party input on. In addition to publishing the invitation to comment on its website, the CMA will typically also send the invitation to comment to specific key third party market participants. There'll also be further written consultations throughout the investigation. For example, when the CMA publishes its draft designation decision. We're also expecting the CMA to engage fairly frequently with third parties through other means, including phone calls, meetings and surveys.

As we've seen, and noted by Chris earlier, Sarah Cardell has acknowledged the importance of engagement with business stakeholders throughout this process. That engagement is designed to be used by the CMA to keep third parties updated on the status of the investigation, discuss available evidence and how best to gather it, and for the CMA to receive teach-ins or technical briefings from firms on their strategy or business. For example, in the context of the second set of investigations on mobile ecosystems, which we will come back to, the CMA is holding a workshop for app developers later in March.

Fiona:

Thanks Issy. It is important for interested third parties to make sure their voices are heard and to actively engage with the CMA throughout this process. We'll have to see over time how much, and in what way, those third party comments do actually feed into the CMA's findings and actions under the new regime. If we move back to the other investigation that you've just mentioned, Chris, can you take us through what's happening there?

Chris:

Sure. The second set of investigations actually launched a couple of weeks after the first, and these are focused on Apple and Google's mobile ecosystems. And again, this is following on from the CMA's market study. Now, notably here, the investigations into those two firms will be conducted in parallel, and the CMA actually issued a single invitation to comment when it started the investigation. I think there's another interesting point here in that the CMA has categorised mobile ecosystems as being a single area of digital activity, despite the fact that it actually covers several different digital activities, for example, mobile operating systems, app stores, browsers and browser engines. Now, under the Act, the CMA has the ability to treat different digital activities as being a single area of activity where it can show that they are used in combination with each other, for example, to facilitate interaction between consumers and users and providers of digital content and services. But it does mean that the scope of the activities being investigated here is extremely broad.

Fiona:

That's interesting. Before the investigations kicked off, we had been speculating about how the CMA might use that power to group activities into a single investigation. It remains to be seen whether the broader scope works in practice, particularly given the tight timetable for an SMS investigation.

Chris:

Yeah, I think that's right. I think stepping back, also, it's worth remembering that mobile ecosystems on devices really do have a very prominent role in the UK. The CMA notes, as we all know, that mobile devices are used by, I think they say, 94% of the UK population over the age of 16. And as a result of that, there's also a large market now for the development of the apps we use. I think almost 15,000 businesses are involved in the development of apps, and the total revenue for that market is estimated to be around £28 billion.

Now, the CMA notes that almost all mobile devices in the UK come pre-installed, either with Apple's iOS operating system or Google's Android operating system, with various then of Apple and Google's own products and services available within those, for example, app stores, browser apps and other apps. So in the investigation, the CMA will be looking at potential concerns over the level of influence that Apple and Google can exert over much of the content and services that are used across mobile devices in the UK. And in the assessment, they'll be considering the impact of the ecosystems on consumers who use their devices as well as the businesses that develop services and content.

Issy:

In its invitation to comment, the CMA included potential conduct requirements to address some of these concerns, including requirements for Apple and Google not to restrict interoperability required for third-party products and services to function effectively, or to enable mobile device users to make active and informed choices about default settings such as default browsers. The invitation to comment has now closed, and we've seen about 40 responses listed on the CMA website, a similar number to that seen in response to the first SMS investigation. We can see input came from a range of parties, including other big tech companies, app developers, financial services firms, industry bodies, SMEs and individuals.

Fiona:

Thanks both. I think another point to flag here is that the CMA concedes that consumer satisfaction levels are high in respect of Apple and Google's mobile ecosystems but, nonetheless the regulator clearly considers that there are potential competitive harms that may need to be addressed. Chris, can you tell us a bit more about that?

Chris:

Yeah, that's right. In its final report in the market study, the CMA acknowledged that there were (and are) high levels of consumer satisfaction for both the Apple and Google mobile ecosystems. But the CMA also pointed out that while high satisfaction levels are a useful indicator of consumer experiences, that does not necessarily imply strong competition. And the CMA considered that actually weak competition may lead to potential harms in those markets that are just not visible to consumers: for example, if innovative products and services are just not making it to the market. I think in the current investigation, the CMA will be looking at (and beyond) consumer experience in considering whether to make a designation decision. That being said actually, shortly after launching the investigations, the CMA did publish a draft consumer survey, so consumer feedback on the ecosystems is clearly still going to inform an important part of their assessment.

Fiona:

Thanks Chris. We'll wait to see that play out and how Apple and Google use that in their responses to potential conduct requirements as well. Final decisions in these investigations must be reached by 22 October, although there is always the possibility of extending the investigation by further three months if certain circumstances arise. As a final point to touch on in this episode, we are expecting the CMA to announce investigations into Amazon Web Services and Microsoft. Issy, can you give listeners a brief overview of what that investigation might look like?

Issy:

No problem. The CMA has indicated that it expects to open an SMS investigation into a third area of a digital activity in the summer, but have not confirmed what that will focus on. However, we have received a clue because in January, the CMA released its provisional findings in its cloud services market investigation, which started in October 2023. These services provide key infrastructure and support that most businesses and organisations use across the UK economy.

The CMA found that spend on cloud services by UK businesses and other organisations has been growing by over 30% each year and was £9 billion in 2023. In its provisional findings, the CMA identified Amazon Web Services and Microsoft as the two largest providers of cloud services. It also considered that the cloud services markets in the UK are highly concentrated with evidence of adverse effects on competition and significant competition concerns. As such, the CMA recommended opening an SMS designation investigation. So it seems possible that this is one to look out for in the summer.

Fiona:

Thanks Issy, and thanks Chris and Issy for joining me today to share your insights on the latest developments under this new regime. As anticipated, the CMA has been quick off the mark in starting these first investigations and targeted areas where potential concerns had already been identified so it'll be interesting to see how those develop and how many more investigations we see this year. One takeaway from these early stages is the way in which third parties can input into the CMA's process. We've seen a wide range of third parties providing comments, including other digital companies, app developers, industry bodies, but also SMEs, individuals and academics. We're therefore seeing the relevance of this new regime not just for big tech, but also for other players.

As expected, we're seeing the CMA investigate companies that have been designated as gatekeepers under the EU's DMA, and we expect to see more of those companies being considered by the CMA under the DMCC regime. This will be an important consideration for companies when discussing potential conduct requirements with the CMA. Unlike the DMA obligations which are set out in the Act itself, the CMA has considerable discretion in scoping the conduct requirements. And designated companies are likely to be keen to ensure that any requirements that the CMA does impose are consistent with the obligations imposed by the DMA, and therefore don't increase the regulatory burden on their businesses and Sarah Cardell's recent comments may provide some reassurance to businesses on this.
Finally, we'd also note that the investigations announced so far have been initiated following substantial work done by the CMA previously, and that might be a good indicator of future SMS investigations as well. We'll look forward to seeing how the CMA's previous work feeds into these latest investigations and how the CMA uses these new tools to deal with the issues that it uncovers. There's plenty to look out for as this regime progresses, and that's just on the digital side. In our next episode, we'll be focusing on the consumer regime under the DMCC Act, which is due to come into force on 6 April, so very shortly.

But that's all from us today. Thank you for listening. To ensure that you don't miss out on any future episodes, subscribe to Ashurst's Legal Outlook now on Apple Podcasts, Spotify, or your favourite podcast platform. And while you're there, please feel free to keep the conversation going and leave us a rating or a review. Until next time, thanks for listening and goodbye for now.