The Juncker curse, named for former European Commission president Jean-Claude Juncker, has a simple but downbeat premise.
Juncker is attributed with saying, with regards to reform of any kind, “We all know what to do, but we don’t know how to get re-elected once we have done it.”
That is the bind that governments across the EU, including Ireland, find themselves in when it comes to putting manners on tech giants.
Last week it looked like the US had stolen a march on the EU with the settlement case agreed by Meta. The action had a nice big number, $18 billion (€15.5 billion), and included promises of changes to its platforms to protect children.
A cursory glance beneath the headlines, however, reveals a far more favourable outcome for Meta.
For starters, only $12.1 billion of that settlement is guaranteed to be paid. Meta’s deal allows it to spread the payments across 10 years as well. The remainder of the settlement will only kick in if rivals such as YouTube and TikTok reach comparable agreements with US regulators.
Meta admitted no wrongdoing in the deal and the core business model remains intact despite promises of changes to how it operates.
Meta has promised a default cumulative limit of two hours of access a day for minors to Facebook and Instagram, with broader access blocked at night by default. The default setting for notifications will see them restricted during school hours. Likes and reaction totals will also be hidden from minors by default.
The word “default” is doing a lot of heavy lifting there.
Meta has settled its US case. What does it all mean?
All of these can, and most likely will, be turned off. Granted, that will be at parental discretion or a reasonable level of snooping skill by youngsters. I’d honestly be more worried if young people couldn’t find workarounds as it would point to a lack of ingenuity.
Furthermore, messaging within these apps doesn’t count towards the daily limit, nor will videos lasting 22 minutes or longer.
Meta’s core systems for providing personalised recommendations, essentially designed to keep the user engaged, will remain the default for minors unless it is switched off.
Make no mistake, this settlement was a win for Meta and the market showed as much. The share price rose to a two-week high immediately following the announcement.
As is the effective motto of this column, it gets worse.
The approach Meta is taking towards implementing the age restrictions brings up a range of privacy concerns. Its methods of age verification includes using identity documents such as passports, facial age estimation and analysis of account activity.
That’s quite some level of snooping. Even with Meta’s plan to not retain the data directly, the security risk that comes with this data being examined alone should have alarm bells ringing.
This is a system that will, by its very nature, process identifiable data of minors.
Of course, in Europe it would be quite difficult for Meta to even try to roll out such a plan. The level of expectation when it comes to privacy at a regulator level is much stricter in the EU.
While facial recognition or identification by Meta wouldn’t be outlawed outright before being submitted for approval by the European Commission, it’s implausible to think EU leaders would approve such a thing based on their past behaviour with tech giants and privacy issues.
That, of course, isn’t why the EU has been criticised the most in the days since the Meta settlement. Questions have been asked as to why the EU hasn’t managed to hit Meta with a fine of this scale.
The headline figure of the fine in the US is, obviously, overstating the impact as it amounts to around €1.5 billion a year for the next decade. Still, the EU hasn’t exactly gone wild with its fines despite having the tools at its disposal.
Investors shrug, but Meta’s $17bn payout comes with a reputational cost
The EU could dish out some utterly enormous fines if it chose to. The maximum penalty under the GDPR is 4 per cent of worldwide annual turnover; under the Digital Services Act (DSA) that rises to 6 per cent, while that goes up twice again with the Digital Markets Act (DMA) to 10 per cent and then 20 per cent for repeat offenders.
The penalties also come with the potential for structural changes, yet we’ve not seen any fine in that realm for anyone. Meta’s record fine under the GDPR was €1.2 billion, barely a quarter of the maximum possible at the time. The DMA and DSA records are even lower.
In July, the commission made a preliminary finding against Meta to do with risks similar to those addressed in the US settlement. Yet here is where the Juncker curse comes into play.
To hit Meta or any tech giant with the maximum fine, along with enforcing real structural changes, you’ve got to be ready for the consequences. Any restriction on Meta services in Europe hits those directly employed by Meta, providers to it, and the countless SMEs using it for advertising and marketing.
Right now, there’s no reason for Meta to believe the EU has the minerals to take that risk. Nor for Google, TikTok or anyone else.
The EU knows how to fix this problem. The people who have to make the decision, however, don’t know how to stay employed afterwards.