United Kingdom

There are currently no digital-specific competition law rules in force in the UK. Digital firms are subject to general competition and consumer protection laws applicable to all firms (e.g., the Competition Act 1998, the Enterprise Act 2002, and the Consumer Rights Act 2015). Digital firms may also be subject to other sectoral regulation, depending on their activities (e.g., telecommunications rules under the Communications Act 2003).

The Government has, however, introduced the Digital Markets, Competition, and Consumers Bill which will create a new “pro–competition regime for digital markets”.¹ The regime is intended to “proactively shape the behaviour of the most powerful technology firms.”²

On April 15, 2023, the Government introduced the Digital Markets, Competition, and Consumers Bill to Parliament. Among other reforms to UK competition and consumer law, the Bill would create a new “pro-competition regime for digital markets” targeting a small number of firms designated as having “strategic market status” (“SMS”) in relation to specific digital activities. The Government consulted on the introduction of the new regime in July 2021,³ and published its response in May 2022.⁴

A number of amendments were made to the Bill in the House of Commons. After the third reading (on 21 November 2023), the Bill was transferred to the House of Lords where it is currently under consideration.

The timing for passage of the Bill is not yet clear, but it is currently expected to receive Royal assent in the first half of 2024, and come into force in late 2024. Once the Act comes into force, the DMU will be able to open investigations to designate firms as having SMS in relation to one or more digital activities and impose conduct requirements (see Question 4 below). The reviews are expected to take up to 9 months and so we are unlikely to see DMU conduct requirements taking effect before 2025.

The Competition and Markets Authority (“CMA”) has welcomed the Bill, saying that it “has the potential to be a watershed moment in the way we protect consumers in the UK and the way we ensure digital markets work for the UK economy, supporting economic growth, investment and innovation.”⁵

The Government has said that the regime will be more flexible than the EU’s Digital Markets Act (see European Union chapter). The UK Secretary of State for Science, Innovation, and Technology stated that “the EU approach is blunt and applies blanket rules on firms, which risks creating unnecessary burdens on business” and that the UK regime—“a key Brexit opportunity”—will be “more flexible, bespoke, and targeted”.⁶

The new regime will be enforced by the “Digital Markets Unit” (“DMU”), a specialist team within the CMA. Since April 2021, the DMU has been operating in shadow form pending establishment of the new regime. As of May 2022 the DMU was reported to have approximately 70 staff members.⁷ According to the CMA’s 2023/2024 annual plan, the DMU accounted for 3.8% of the CMA’s staff time from January to December 2022.⁸ The CMA also said it plans to recruit more DMU staff in preparation for the regime coming into force, particularly at its new Manchester office. ⁹

The UK pro-competition regime for digital markets will be structured as follows:

• The DMU will designate firms as having SMS in relation to specific digital activities following evidence-driven assessments (see Question 4 below).
• The DMU will have the power to impose “conduct requirements” on SMS firms, specifying how the designated firm must conduct itself in relation to a relevant digital activity (see Question 5 below).
• Following a “conduct investigation”, the DMU will have the power to impose fines and remedies on firms that breach the conduct rules (see Question 10 below). It will also be able to issue interim orders to pause or reverse actions taken by SMS firms if they breach conduct requirements.
• Separate to conduct requirements, the DMU will be able to impose targeted “pro-competitive interventions” (“PCIs”) on SMS firms to remedy adverse effects on competition. The remedies available to the DMU match those the CMA can impose following a market investigation under the Enterprise Act 2002, including behavioral and structural remedies.

The costs of the new regime will be partially recouped through a levy on SMS firms.¹⁰

The new regime will apply to firms designated as having strategic market status (“SMS”). An undertaking as a whole will be designated as having SMS, but the rules will only apply to designated activities.¹¹

Test for Establishing SMS

The Bill’s test for SMS comprises the following five components:¹²

• There must be a digital activity, which essentially means the provision of a service by means of the internet or of digital content.
• The firm must have substantial and entrenched market power in respect of the digital activity. This means that the digital activity lacks good alternatives, there is limited threat of entry or expansion, and the firm’s position is likely to persist over time. Under the Bill, the DMU must “carry out a forward-looking assessment of a period of at least 5 years, taking into account developments that (a) would be expected or foreseeable if the CMA did not designate the undertaking as having SMS [...], and (b) may affect the undertaking’s conduct in carrying out the digital activity.”¹⁵
• The firm must have a position of strategic significance in respect of a digital activity.¹⁶ This requirement will be satisfied if the DMU establishes that: (i) the undertaking has achieved a position of significant size or scale in respect of the digital activity; (ii) a significant number of other undertakings use the digital activity in carrying on their business; (iii) the undertaking’s position in respect of the digital activity would allow it to extend its market power to a range of other activities; or (iv) the undertaking’s position in respect of the digital activity allows it to determine or substantially influence the ways in which other undertakings conduct themselves.¹⁷
• The digital activity must have a UK nexus.¹⁸ The activity’s link to the UK will be defined according to whether it has a significant number of UK users, the undertaking carries out business in the UK in relation to the digital activity, or the digital activity or the way it is carried out is likely to have an immediate, substantial, and foreseeable effect on trade in the UK.¹⁹ The regime therefore captures conduct implemented outside the UK as long as it has an effect in the UK.
• The undertaking’s annual turnover must exceed £25 billion globally or £1 billion in the UK.²⁰

Procedure for SMS Designation

The procedure for SMS designation will be as follows:

• Initial SMS investigation. When an undertaking has not been designated as having SMS in respect of a particular activity, the DMU may begin an “initial SMS investigation” if it has reasonable grounds to consider that it may be able to designate an undertaking as having SMS in respect of a digital activity.²¹ It can do so even if it has previously decided not to designate the firm in respect of the activity in question.²²
• Further SMS investigation. The DMU can undertake a “further” SMS investigation in respect of an already-designated activity, not later than 9 months before the end of the designation period.²³ The purpose of a further SMS investigation is to assess whether to revoke the designation, designate the undertaking in respect or a similar or connected digital activity, or put measures in place to manage the impact of a revocation on third parties or users.²⁴
• Length of investigation. An SMS investigation will have a statutory deadline of 9 months, extendable by 3 months in exceptional circumstances.²⁵
• Duration of designation. A designation order will last 5 years from the day an SMS decision notice is given.²⁶
• Consultation. The DMU must consult publicly on any decision it is considering making as a result of its SMS decision.²⁷

The CMA’s final report in its Mobile Ecosystems market study gives some indication as to its anticipated approach to SMS designation once the new regime is in place.²⁸ The CMA concluded that Apple and Google would both meet the then proposed test for SMS in relation to the supply of mobile operating systems (and, in Apple’s case, the devices on which they are installed), native app distribution, mobile browsers, and browser engines.

SMS firms will be required to follow legally enforceable conduct requirements, which would set out how they are expected to behave. In particular, the rules governing SMS firms will consist of the following elements:

• Overarching objectives. The Bill sets out three overarching objectives to guide the aims and scope of SMS firms’ conduct requirements.²⁹ These objectives are:
  
  
  • Fair dealing: users should be treated fairly and be able to interact, directly or indirectly, on reasonable terms with SMS firms.³⁰
  • Open choices: users should be able to choose freely and easily between services provided by firms designated with SMS and other firms.³¹
  • Trust and transparency: users should have access to clear and relevant information to understand the services SMS firms are providing (including their terms), and to make informed decisions about whether and how they interact with the firm.³²
• Permitted conduct requirement types. Conduct requirements developed by the DMU must belong to a permitted type, as set out in legislation.³³ The Bill includes types of requirements such as trading on fair and reasonable terms, having effective processes for handling complaints by and disputes with users, presenting default choices in ways that allow users to make informed and effective decisions, not using the firm’s position to favor its own products, and not restricting interoperability between the relevant service and rivals’ services.³⁴
• Firm-specific conduct requirements. The DMU will specify legally binding, tailored conduct requirements. These requirements will set out how an SMS firm must conduct itself in relation to a relevant digital activity.³⁵ The DMU may only implement a conduct requirement if it is proportionate to do so for the purposes of achieving the fair dealing, open choices, or trust and transparency objectives.³⁶ It must also have regard to the likely consumer benefits that will result from the conduct in question.³⁷ The DMU will also have the power to remove or amend conduct requirements. Under the Bill, the DMU will have a duty to carry out a public consultation on the proposed conduct requirements and a duty to keep the conduct requirements imposed under review.³⁸
  
  In the CMA’s final report in the Mobile Ecosystems market study, it identified examples of Apple’s and Google’s practices that it anticipated could be addressed by conduct requirements.³⁹ For example, responding to concerns that Apple prevents users switching from iOS mobile devices to Android mobile devices, the CMA considered that rules preventing Apple from denying or restricting interoperability between its software and hardware with Android devices could be appropriate.
  
  The publication of conduct requirements will not be subject to a statutory deadline, but the DMU is expected normally to publish conduct requirements along with its SMS designation decisions.
  
• Firm-specific guidance. The DMU will have the ability to develop guidance to explain how the firm-specific conduct requirements apply to that firm. The guidance would not itself be legally binding.
• Pro-competitive interventions (“PCIs”). Separate from firm-specific conduct requirements, the DMU will have the power to impose PCIs to address SMS firms’ market power and undermine it over time.⁴⁰ The remedies available to the DMU through PCIs—and the process of imposing them—will resemble the existing market investigations regime under the Enterprise Act 2002. Potential remedies will include behavioral, structural, and informational interventions. Before imposing PCIs, the DMU will have to establish that a factor or combination of factors relating to a relevant digital activity is having an adverse effect on competition (AEC).⁴¹ The DMU can only impose PCIs if it would be proportionate for the purposes of remedying, mitigating, or preventing the AEC it has identified.⁴²
  PCI investigations will have a statutory deadline of nine months, extendable by up to 3 months.⁴³
  

Conduct Requirements vs. PCIs

The Bill does not make clear the precise relationship between conduct requirements and PCIs.

The Government has explained that conduct requirements seek to prevent the exploitation of existing market power rather than address the source of market power.⁴⁴ By contrast, PCIs are designed to “tackle the root causes of entrenched market power.”⁴⁵ According to the CMA’s vision for the regime, PCIs could be used to address competition issues that do not involve changing a firm’s existing behavior (in which case conduct requirements would be a better instrument).⁴⁶ Given the potentially intrusive actions that could be imposed through PCIs, such as structural remedies or mandating interoperability, the Bill proposes that PCIs are subject to a higher legal threshold: the DMU must establish an AEC before imposing a PCI.⁴⁷

The Government’s explanation of the delineation between conduct requirements and PCIs makes sense. But this delineation does not seem to be reflected in the wording of the Bill, which does not explain the circumstances in which PCIs or conduct requirements should be used. The confusion is illustrated by the example of interoperability: both the Government⁴⁸ and CMA⁴⁹ identify mandating interoperability as an example of a PCI. But the Bill would enable the DMU to implement conduct requirements that prevent a SMS firm from “restricting interoperability between the relevant services or digital content and products offered by other undertakings.”⁵⁰ It is not clear whether this conduct category could be used by the DMU to require an SMS firm to offer interoperability for the first time or whether it only applies to restrictions on interoperability that are already in place. The Government’s intention appears to have been the latter.

There are no specific rules in the Bill regarding digital platforms’ relationships with publishers in the UK. The Bill includes a final-offer mechanism for resolving disputes regarding transactions between platforms and third parties, but this is not specific to publishers (see further Question 10 below).⁵¹

The Bill does not require the DMU to demonstrate the competitive effects of SMS firms’ conduct in order to establish a breach of their conduct requirements. The DMU will, however, need to consider (i) whether imposing a conduct requirement is proportionate to achieve its intended objective; (ii) the likely consumer benefits that would result from imposing the requirement; and (iii) firms’ arguments that their conduct is justified by reference to consumer benefits when it investigates breaches of conduct requirements (see Question 8). Whether conduct creates anticompetitive effects may therefore be considered as part of the overall assessment of whether an alleged breach results in a net adverse impact on competition.

In addition, the Government has emphasized that SMS designations and conduct requirements will be implemented “according to the evidence.”⁵² There is therefore expected to be scope for engagement with the DMU as it develops conduct requirements, during which firms will be able to adduce evidence about the effects of their conduct.

In order to impose PCIs, the DMU will need to demonstrate an adverse effect on competition.⁵³ This standard of proof is well developed as a measure of anticompetitive effects in the market investigations regime under the Enterprise Act 2002.

Conduct Requirements

The Bill contains an exemption⁵⁴ to ensure that conduct which results in net consumer benefits will not breach conduct requirements. This reflects the recognition, as stated by the CMA, that “conduct which may in some circumstances be harmful, in others may be permissible or desirable as it produces sufficient countervailing benefits.”⁵⁵ Similarly, the Government stressed that SMS firms must be able to bring forward evidence that their conduct creates benefits to consumers and that the “DMU will not be able to take action against conduct that on balance benefits consumers.”⁵⁶ This is a notable point of distinction from the EU’s Digital Markets Act, which contains no express consumer benefit defense (and which the Government has sought to distance the Bill from⁵⁷) (see European Union chapter).

Accordingly, SMS firms will be exempted from conduct requirements where the following four conditions are satisfied:⁵⁸

1. The conduct gives rise to benefits to users or potential users of the relevant digital activity;
2. Those benefits outweigh any actual or likely detrimental impact on competition resulting from a breach of the conduct requirement;
3. Those benefits could not be realized without the conduct;
4. The conduct is proportionate to the realization of those benefits; and
5. The conduct does not eliminate or prevent effective competition.

In addition, two other mechanisms in the Bill would ensure that the DMU does not impose conduct requirements that could sacrifice important consumer benefits. First, the DMU must take account of consumer benefits when it develops and imposes conduct requirements in the first place.⁵⁹ Second, the DMU may only impose conduct requirements if it would be proportionate to do so to achieve the objectives of fair dealing, open choices, or trust and transparency.⁶⁰

PCIs

Before imposing PCIs, the DMU may take into account any countervailing benefits when considering whether an AEC exists.⁶¹ The DMU must only impose a PCI if it is proportionate to do so to resolve the AEC the DMU has identified.⁶²

Investigatory safeguards. The Bill grants the DMU broad investigatory powers, including the power to enter business premises without a warrant and interview individuals.⁶³ However, the DMU’s range of information gathering tools are “subject to appropriate safeguards.”⁶⁴ These safeguards include limitations to the use of interview statements in prosecution⁶⁵ and the protection of privileged information.⁶⁶

Consultations. The DMU will have a duty to consult publicly before taking SMS designation decisions,⁶⁷ imposing remedies following a PCI investigation,⁶⁸ imposing conduct requirements,⁶⁹ and on the guidance that it publishes.⁷⁰ Affected parties and third parties therefore have an opportunity to provide input on the DMU’s proposed decisions.

Appeals. Firms will be able to appeal decisions of the DMU (including SMS designation decisions, decisions finding violations of conduct requirements, and PCIs) to the Competition Appeal Tribunal.⁷¹ The standard of appeal will be ordinary judicial review grounds,⁷² as in the UK mergers and markets regimes (as opposed to full merits appeals, as in Competition Act 1998 investigations), except for DMU penalty decisions, which are subject to a full merits appeal.⁷³

Guidance. Under the Bill, the DMU must publish guidance on how it proposes to exercise its functions under the new regime.⁷⁴ Before it does so, it must consult such persons as it considers appropriate and obtain the Secretary of State’s approval.

Reserved decisions. Under the Bill, certain decisions are reserved to be taken by the CMA Board or delegated by them to a committee or subcommittee of the Board.⁷⁵ In particular:

• Decisions on whether to begin an initial or further SMS investigation or PCI investigation are reserved for the CMA Board and cannot be delegated.
• Certain other decisions can be delegated to a committee or sub-committee of the Board, but not to an individual Board or CMA staff member. Such decisions include whether to make an SMS designation; impose or revoke conduct requirements; order, replace, or revoke a remedy imposed under a PCI; make enforcement orders (except interim orders); adopt the final offer mechanism (see Question 10 below); accept commitments; or impose penalties.

A UK government official has stressed that the DMU should prioritize “constructive engagement” with SMS firms over enforcement measures like penalties and court orders.⁷⁶ The CMA has for its part stated that, where “evidence is clear that intervention is needed,” the DMU will always act “in a way that is proportionate to the harms to businesses and consumers.”⁷⁷ Indeed, the Bill contains an express duty for the DMU to consider the proportionality of its actions before imposing conduct requirements or remedies following pro-competitive intervention investigations.

Nonetheless, the Bill includes powers for the DMUs to impose far-reaching fines and remedies.

Fines

SMS firms in breach of DMU decisions will face financial penalties of up to 10% of global annual turnover for the most serious offenses, and up to 5% of daily worldwide turnover for continued breaches. A lower level of 1% of global annual turnover (and up to 5% for each day of ongoing non-compliance) will apply to information offenses.

Remedies

Where the DMU finds that an SMS has breached a conduct requirement, it will be able to make an order imposing such obligations as it considers appropriate to stop the breach, prevent it happening again, or address damage caused by it.⁷⁸ It will have a similar power to impose interim order in respect of suspected breaches.⁷⁹ In addition, as explained at Question 5, the DMU will be able to impose targeted PCIs on firms.

Personal Liability

The DMU will be able to apply to the court to disqualify individuals from holding company directorships in the UK and also to impose civil penalties on named senior managers who fail to ensure that their firms comply with information requests. It will also be empowered to apply criminal penalties where false or misleading information is provided (as is already the case for other CMA functions).

Final-Offer Mechanism

Following a breach of a conduct requirement and enforcement order relating to payment terms for a transaction between the parties, the DMU will be able to adopt a so-called “final offer mechanism” if it considers that it could not satisfactorily resolve the breach using any of its other digital markets functions.⁸⁰ Under this mechanism, the parties would submit to the DMU final offer payment terms, with the DMU deciding which terms should be applicable to the relevant transaction.⁸¹ Parties can appeal the outcome of the final-offer mechanism to the Competition Appeal Tribunal on judicial review grounds.⁸²

Under the Bill, the CMA can invite “joined third parties” to make a “single submission” to the DMU of final offer payment terms that the third parties “collectively regard as fair and reasonable”.⁸³ The CMA may then decide the terms that should be applicable to the grouped transaction.

Although this mechanism appears to draw on proposals by the DMU and the UK telecommunications regulator, Ofcom, regarding digital platforms and online publishers,⁸⁴ the mechanism is not limited to SMS firms dealings with online publishers: it could apply to any transactions with SMS firms involving payment transactions.

The Bill⁸⁵ and the Government’s response to the consultation regarding the proposed pro-competition regime for digital markets represent the most up-to-date guidance on how the new regime will operate. They build on the recommendations of the Digital Competition Expert Panel led by Professor Jason Furman⁸⁶ and advice from the CMA’s Digital Markets Taskforce.⁸⁷

The CMA’s final reports in the Online Platforms and Digital Advertising and Mobile Ecosystems market studies include recommendations on how the new regime might apply to the markets considered in those studies.⁸⁸

The proposed regime is principally competition based. It does, however, touch on conduct relating to a range of related issues, such as data usage, consumer protection (e.g., in relation to online choice architecture), and online privacy. The Government has separately introduced an Online Safety Bill that would apply to firms which host user-generated content.⁸⁹

The CMA has doubled down on its use of existing enforcement tools in digital markets in recent years, including because of previous delays to introducing digital regulation. Investigations into companies expected to be covered by the proposed regime include:

• Apple App Store (opened in March 2021, ongoing). The CMA is investigating suspected breaches of UK competition law by Apple in relation to the distribution of apps on iOS and iPadOS devices, in particular the terms and conditions governing app developers’ access to the App Store.⁹⁰ The investigation is ongoing.
• Meta’s collection and use of ad data (opened in June 2021, closed November 2023). The CMA investigated Meta’s conduct in relation to the collection and use of data in the context of providing online advertising services and Facebook’s single sign-on function, and whether this resulted in a competitive advantage over downstream competitors.⁹¹ On November 3, 2023, the CMA accepted commitments from Meta. Under the commitments, Meta will allow businesses that advertise on Meta platforms to opt out of their data being used to improve Facebook Marketplace.⁹²
• Google’s conduct in ad-tech (opened in May 2022, ongoing). The CMA is investigating whether Google’s practices in three parts of the ad-tech chain (demand-side platforms, ad exchanges, and publisher ad servers) distort competition.⁹³ In March 2023, the CMA combined this investigation with a separate investigation it had been carrying out into whether Google abused a dominant position through its conduct in relation to header bidding services.
• Google’s conduct in the distribution of apps on Android devices (opened in June 2022, ongoing). The CMA is investigating Google’s conduct in relation to distribution of apps on Android devices in the UK, in particular Google’s Play Store rules which require certain app developers to use Google’s own payment system for in-app purchases.⁹⁴ In April 2023, the CMA published a notice of intention to accept binding commitments.⁹⁵
• Amazon’s Marketplace (opened in July 2022, closed November 2023). The CMA investigated Amazon’s conduct in relation to the way non-public third party seller data may be used within Amazon’s retail business, how Amazon set criteria for selecting which product offer was placed in the “Buy Box”, and which sellers could list products under Amazon’s “Prime label” on its Marketplace in the UK.⁹⁶ On November 3, 2023, the CMA accepted commitments from Amazon.⁹⁷ The commitments require Amazon to (i) refrain from using data received from merchants through their use of Amazon’s Marketplace to compete with those merchants; and (ii) apply objective and non-discriminatory criteria in determining which offers appear in Amazon’s “Buy Box”.
• Market investigation reference into mobile browsers and cloud gaming (opened in November 2022, on hold). Following its Mobile Ecosystems market study,⁹⁸ the CMA launched a market investigation into mobile browsers and cloud gaming.⁹⁹ The decision to launch a market investigation reference was driven in part by the delays to the legislation introducing the pro-competition regime.¹⁰⁰ In March 2023, the CAT quashed the CMA’s decision to open the investigation as the CMA was out of time to make the reference and so the investigation is currently on hold.¹⁰¹ The CMA appealed the CAT’s ruling, and the Court of Appeal found in favor of the CMA on 30 November 2023.¹⁰² The CMA has indicated that it stands ready to reopen the investigation once the legal process is complete (following any further appeal by Apple).

The CMA has also carried out several consumer protection investigations into digital firms under UK consumer legislation, including:

• Anti-virus software (opened in December 2018). Following an investigation into the anti-virus software sector, in particular the automatic renewal of anti-virus subscriptions, the CMA agreed commitments with McAfee and Norton.¹⁰³
• Online console video gaming (opened in April 2019). Following an investigation into auto-renewal practices in respect of Nintendo Switch, PlayStation, and Xbox, the CMA agreed commitments with Sony, Nintendo, and Microsoft.¹⁰⁴
• Fake reviews (opened in June 2019). The CMA is currently investigating whether Amazon and Google took sufficient action to protect users from fake reviews.¹⁰⁵ This investigation follows an initial investigation into several other digital businesses (e.g., eBay and Meta) on the same topic.¹⁰⁶
• Use of ‘urgency claims’ by Wowcher Group (opened March 2023). The CMA is investigating whether Wowcher Group used so-called ‘urgency claims’ (such as countdown timers) to mislead consumers.¹⁰⁷ The CMA announced on November 16, 2023 that it had found evidence that Wowcher had misled consumers and invited Wowcher to offer undertakings to avoid court action.¹⁰⁸

The Bill contains a mandatory reporting regime for certain mergers before the relevant transaction can be completed. SMS firms will have to report any transaction where:¹⁰⁹

• The SMS firm acquires an equity or voting share in the target that increases from less than 15% to 15% or more, from 25% or less to more than 25%, or from 50% or less to more than 50%;
• The value of the consideration provided by the SMS firm is over £25 million; and
• The transaction meets a UK nexus test.

The format and content of the report that must be provided will be set by the CMA. When the CMA receives a report, it must within 5 working days give notice to the reporting firm that the CMA accepts the report is sufficient.¹¹⁰

A SMS firm will not be able to complete its transaction without submitting a report or before 5 working days after the CMA accepts that the report is sufficient.¹¹¹

In addition, the Bill introduces changes to its merger notification thresholds for all firms under a wider set of reforms to competition law. These changes, intended to capture so-called “killer acquisitions”, will result in the CMA having jurisdiction to review transactions where the acquirer has both:¹¹²

• An existing 33% share of supply of goods or services of any description in the UK; and
• Over £350 million of UK turnover.