Banner1.jpg

CdS - 202301618

From GDPRhub
Revision as of 10:52, 28 January 2025 by Elu (talk | contribs) (Created page with "{{COURTdecisionBOX |Jurisdiction=Italy |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=CdS |Court_Original_Name=Consiglio di Stato |Court_English_Name=Council of State |Court_With_Country=CdS (Italy) |Case_Number_Name=016182023 |ECLI= |Original_Source_Name_1=Giustitia Amministrativa |Original_Source_Link_1=https://portali.giustizia-amministrativa.it/portale/pages/istituzionale/visualizza/?nodeRef=&schema=cds&nrg=202301618&nomeFile=202500080_11.html&sub...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
CdS - 016182023
Courts logo1.png
Court: CdS (Italy)
Jurisdiction: Italy
Relevant Law:
Article 20 Codice Consumo
Article 21 Codice Consumo
Article 22 Codice Consumo
Article 24 Codice Consumo
Article 25 Codice Consumo
Article 27 Codice Consumo
Decided:
Published: 07.01.2025
Parties: Google Ireland
National Case Number/Name: 016182023
European Case Law Identifier:
Appeal from:
Appeal to: Unknown
Original Language(s): Italian
Original Source: Giustitia Amministrativa (in Italian)
Initial Contributor: elu

The Court held that, due to the “incompatibility criterion”, the Antitrust Authority, and not the DPA, could investigate on Google´s privacy policy and “opt-out” mechanism to acquire consent to use the user's data for commercial purpose.

English Summary

Facts

Google Ireland Limited appealed to a decision of the Competition Authority to the Supreme Administrative Court (hereinafter: the court), which imposed on them a €10 million fine for unfair competition under competition laws.

The Competition Authority differentiated between two different conducts undertaken by Google:

a. When creating a Google account, indispensable to access all Google services, and in the phase of use of various services offered by Google, Google provided in its privacy policy information lacking immediacy, clarity and completeness, with reference to his activity of acquisition of personal data and research of user for commercial purposes;

b. When creating a Google account, Google applies an “opt-out” mechanism to acquire consent to use the user's data for commercial purpose. This means that the option available to the user to authorize or not this modality is, in fact, pre-set on acquiring the data for Google when creating the Google ID, a compulsory step for consumer to be able to Google's services.

Google advanced three points on appeal:

1. The Competition Authority is not competent to rule on the two practices, as they are subject to the DPA;

2. The Competition Authority erred in their analysis of Articles 20, 21 and 22 of the Consume Code as Google does not engage in unfair commercial practices;

3. The Competition Authority erred in their analysis of Articles 20, 24 and 25 of the Consume Code as Google does not engage in aggressive practices;

4. The Competition Authority erred in the establishment of the fine amount, violating Article 27(9) and (13) Consume Code.

Due to the data protection scope of GDPRhub, only Point 1 of the Appeal will be considered in depth.

Holding

Point 1: Antitrust Authority or DPA competence?

The court considered that the matter at hand concerned the “action finium regundorum”, i.e. the fine bordering line between the competences of the Competition Authority and the DPA.

EU jurisprudence has regularly followed the “incompatibility criterion”, which allows for the intervention of the specialized authority, in this case the DPA, only when the conduct disputed concerns “specific matters”, i.e. matters that are excluded from antitrust competences.

The “incompatibility criterion” is construed in light of the general rule establishing that, in the context of an unfair commercial practice, the competence of other specialized authorities is residual and prevails only when the framework of the specialized authority regulates specific aspects of the matters at issue that render the two frameworks incompatible. In the case at hand, Google´s privacy policy should protest personality rights, and not consumer rights. Thus, under this analysis, the privacy policy constitutes a sectorial norm, thus triggering the application of the “incompatibility criterion”.

In fact, the object of the Antitrust decision does not concern the lawfulness of the data processing, but rather the modalities behind the exploitation of such data for commercial purposes in a B2C relation. Thus, the case at hand does not concern a data protection violation, but instead the opacity behind the incomplete privacy policy concerning exploitation of personal data for commercial purposes.

Google in fact collects personal data of users and uses them to engage in profiling to sell them to third parties for advertising purposes. There is thus a trilateral relation: users access Google´s services, Google makes these data, which contribute to the profiling of users, available to third parties, which themselves advertise their products for profit.

This dynamic is rendered clear by the fact that the revenue from advertisement services constitute the main source of revenue for Google, and that all online platforms that are not behind a paywall monetize through advertisement.

Thus, the Court concluded that no EU legislation on data protection regulates specific aspects of unfair commercial practices, thus, in light of the normative framework construed by previous CJEU judgements, the Antitrust Authority was correctly considered competent to investigate and adopt a decision on the merits of this case.

The Court further dismissed all requests for preliminary ruling advanced by Google under Article 267(3) GDPR as the questions raised by Google do not raise any doubt as per the interpretation of EU law, but rather wanted the CJEU to decide on the merits of the claim, which is not allowed in the EU legal framework.

Point 2, 3 and 4: Unfair commercial practices and Aggressive practice?

In relation to Point 2, 3 and 4 raised by Google in appeal, the Court found that Google´s privacy policy lacking immediacy, clarity and completeness (Conduct a) amounted an unfair commercial practice (Point 2) and an aggressive practice (Point 3). Thus, the sanction in relation to such use (Point 4) was correctly determine. To conclude, in relation to Conduct a, the appeal was dismissed.

In relation to Point 2, 3 and 4 raised by Google in appeal, the Court found that Google´s privacy policy lacking immediacy, clarity and completeness, the appeal was partly unfounded.

Consequently, the Court decided to reduce the fine imposed by the Antitrust Authority from €10 million to €5 million.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

Published on 01/07/2025

N. 00080/2025REG.PROV.COLL.

N. 01618/2023 REG.RIC.

ITALIAN REPUBLIC

IN THE NAME OF THE ITALIAN PEOPLE

The Council of State

in jurisdiction (Sixth Section)

has issued this

JUDGMENT

on the appeal general register number 1618 of 2023, filed by Google Ireland Limited, in the person of its legal representative pro tempore, represented and defended by the lawyers Claudio Tesauro, Mario Siragusa, Fausto Caronna and Angelo Raffaele Cassano, with digital domicile as per PEC from the Justice Registries;

against

Antitrust Authority, in the person of its legal representative pro tempore, represented and defended by the Attorney General of the State, domiciled ex lege in Rome, via dei Portoghesi, 12;

against

U.DI.CON. APS (Unione Difesa Consumatori), in the person of its legal representative pro tempore, represented and defended by the lawyers Donato Patera and Giuseppe Catalano, with digital domicile as per PEC from the Justice Registers;

for the reform

of the ruling of the Regional Administrative Court for Lazio, First Section, no. 15326 of 18 November 2022.

Having seen the appeal and the related attachments;

Having seen the documents of appearance in court of the Antitrust Authority and of U.DI.CON. APS;

Having seen all the documents of the case;

Rapporteur, in the public hearing of 12 December 2024, the Councilor Roberto Caponigro and having heard the lawyers Angelo Raffaele Cassano, Mario Siragusa and Fausto Caronna;

Considered and considered in fact and law as follows.

FACT and LAW

1. The Competition and Market Authority, in its meeting of 16 November 2021, resolved:

a) that the commercial practice described in point II, sub a), of the provision, implemented by Google Ireland Ltd. constitutes, for the reasons and within the limits set out in the grounds, an unfair commercial practice pursuant to Articles 21 and 22 of the Consumer Code, and prohibits its dissemination or repetition;

b) that the commercial practice described in point II, sub b), of the provision, implemented by Google Ireland Ltd. constitutes, for the reasons and within the limits set out in the grounds, an unfair commercial practice pursuant to Articles 24 and 25 of the Consumer Code, and prohibits its dissemination or repetition;

c) to impose on Google Ireland Ltd. an administrative fine of €5,000,000 (five million euros) for the violation referred to in letter a);

d) to impose on Google Ireland Ltd. an administrative fine of €5,000,000 (five million euros) for the violation referred to in letter b);

e) that the Professional communicate to the Authority, within ninety days of notification of the measure, the initiatives undertaken in compliance with the formal notice referred to in point a).

The proceedings initiated by the Antitrust Authority concerned two separate practices implemented by Google, having as their object the collection and use, for commercial purposes, of the data of its users - consumers, both in the phase of creating the Google ID and in the phase of access to other services offered by the Company, which, in turn, involve the collection of data.

In particular, the Authority has distinguished the two practices as follows:

Practice a)

In the phase of creating the Google account, which is essential for the use of all the services offered by the Company, and in the phase of using various services offered by Google, the Professional has adopted a notice lacking immediacy, clarity and completeness, in reference to its activity of acquiring personal data and researching the user for their use for commercial purposes.

Practice b)

The Professional, where the consumer proceeds to create a Google account, applies a procedure based on a method of acquiring consent to the use of user data for commercial purposes in opt-out, i.e. without providing the consumer with the ability to make a prior and express choice regarding the transfer of their data. The option available to the user to authorize or not this method is, in fact, pre-set on the possibility of data acquisition for the Company in the phase of creating the Google ID, an obligatory step for the consumer who intends to use most of Google services.

Google Ireland Ltd. (hereinafter Google) challenged this provision before the Regional Administrative Court for Lazio, which, with the ruling of the First Section no. 15326 of 18 November 2022, rejected the appeal.

Google therefore filed this appeal, articulating the following grounds for appeal:

I. On the incompetence of the AGCM: nullity due to absolute lack of attribution, incompetence, violation and false application of Articles 1, 18, 20, 21, 24 and 25 of the Consumer Code. Excess of power due to lack of investigation and motivation, illogicality, unreasonableness, misrepresentation of fact and law.

The AGCM would have intervened on aspects outside its sphere of competence, entirely regulated by the privacy legislation and entrusted to the care of the Guarantor for the protection of personal data.

There would be a manifest contradiction between the resolution criteria set out, respectively, in the ruling of the Council of State no. 2631 of 2021, the so-called Facebook ruling (complementarity) and in the so-called Carte TIM ruling of the Court of Justice of the European Union issued on the joined cases C-54/17 and C-55/17 (incompatibility).

In fact, by applying the Carte SIM ruling, the jurisdiction could be, alternatively, of the Guarantor or of the AGCM, while, by applying the criterion of the Facebook ruling, both Authorities would always be competent.

The Court of Justice, to date, has not ruled on the relationship between privacy legislation and legislation on unfair commercial practices, given that the Carte SIM ruling concerns sectoral regulations (in this case that of the electronic communications sector), not a general regulation, applicable across all sectors, such as privacy legislation.

By applying the criterion of incompatibility (set out in the Carte SIM ruling and in the subsequent administrative case law developed on it), one should conclude that, given the non-existence of an antinomic contrast between the legislation on unfair commercial practices and the privacy legislation, the former should always prevail, with the consequence that the latter would never apply to all conducts that, like the one at issue in this judgment, are subject to both sets of regulations.

By invoking, as the TAR Lazio did, both the criterion of complementarity and the criterion of incompatibility at the same time, as criteria for resolving the relationship between rules with respect to the same material conduct, one would arrive at conclusions that are not only manifestly contradictory, but also inadmissible, giving rise to duplication of sanctioning measures against companies.

In order to avoid the above-mentioned opposite outcomes, both of which are inadmissible (i.e., according to the criterion of incompatibility of the SIM Cards case law, always and in any case prevalence of the legislation on unfair commercial practices, with consequent non-application of the privacy legislation or, according to the criterion of complementarity of the case law, only national, Facebook, parallel application of the two complexes, with systematic endorsement of duplication of interventions), the criterion for resolving the relationship between the rules should be different.

Where specific conduct, such as the one at issue, can be subsumed under both the privacy legislation and the legislation on unfair commercial practices, and are entirely and completely regulated by the former - with the effect of protecting the freedom of determination of individuals with respect to the use of personal data, not only as an expression of a fundamental right of the person, but also as an expression of the economic freedom of the individual as a consumer - the prevalence of the privacy legislation over that of unfair commercial practices should be recognized, with consequent incompetence of the AGCM.

It would be necessary to correctly interpret and apply the relationship rule referred to in art. 3(4) of Directive 2005/29/EC (implemented in Italy by art. 19(3) of the Consumer Code) in relation to the relationship between consumer protection legislation and privacy legislation, an issue which the Court of Justice ruling in the SIM Cards case did not address. On the other hand, a situation of real “contrast” would occur whenever – as occurred in the case in question – the same act or fact, abstractly subsumable within the scope of application of the legislation on unfair commercial practices, is at the same time also subject to privacy legislation, with specific provisions that fully regulate all its aspects, also absorbing the protection of consumers’ “economic” choices. Indeed, given that Directive 2005/29/EC dictates a complete harmonization that does not allow Member States to prepare a different regime (be it more or less favorable to consumers) (ex multis Court of Justice, 22 April 2009, joined cases, C-261/07 and C-299/07, § 52), privacy provisions that dictate a different regime (for example, in terms of the methods of protection of contractual freedom), would be in irreconcilable conflict with Directive 2005/29/EC, with consequent inapplicability.

Ultimately, in this case, the protection of the consumer's economic choices would be entirely absorbed by the privacy legislation, so that, for such conduct, i.e. the provision of consent to the processing of personal data for commercial purposes, there would be no margins not regulated or not adequately protected by such legislation with respect to which the further and duplicative protection provided by the general legislation on unfair commercial practices could be applied, which, therefore, would be inapplicable, with the consequent incompetence of the AGCM.

Should there be doubts about the correct interpretation and application to the case in question of the above-mentioned legal rules and principles, the appeal judge would be required, in compliance with the obligations arising from EU law as a “national judicial body, against whose decisions no judicial remedy under national law may be brought” pursuant to and for the purposes of art. 267(3) TFEU, to first submit preliminary questions to the Court of Justice of the European Union.

The choice of users to consent to the processing of their personal data for advertising purposes would not constitute a “commercial decision” pursuant to the Consumer Code, given that the data have never represented the “price” or the “consideration” provided by users to access the Services or to create an Account, so that, even in this respect, the AGCM would not have jurisdiction in the matter.

Users would always have had full and unconditional access to the Services and Google Account, even if they had not authorized the use of their data for commercial purposes and this would mark a radical difference compared to other cases.

In the case of Google, there would be no mutually exclusive relationship between access to a given service and the provision of data by the user, so speaking of a “commercial decision” by users would be clearly incorrect, as a consumer would adopt a “commercial decision” relevant under consumer law when he or she pays a price or, in any case, provides a consideration in order to obtain a product or service.

II. On the absence of deceptive practices: violation and false application of Articles 20, 21 and 22 of the Consumer Code and Articles 5, 6 and 7 of Directive 2005/29/EC, abuse of power in all its symptomatic forms, lack of investigation, misrepresentation of fact and law, erroneous assumptions, illogicality, contradictory nature and unreasonableness.

The AGCM has contested Google for not having adequately informed consumers about the possibility that their data could be used to show personalized ads.

The reconstruction carried out by the Authority, also confirmed by the TAR Lazio, would be incorrect because (a) it is based on an evident misrepresentation of the facts and (b) it culpably ignores the fundamental parameter for verifying the deceptiveness of a commercial practice: that of the average consumer.

In fact, there would be no information “of merely eventual consultation” and/or “characterized by information opacity”.

Directive 2005/29/EC (articles 5, 6 and 7) and the Consumer Code (articles 20, 21 and 22) expressly provide that, in order to determine whether a commercial practice is to be considered misleading, it is necessary to verify whether it is capable of altering the behavior of the so-called "average consumer", i.e. of a subject who is "normally informed and reasonably observant and circumspect" (see ex multis Court of Justice in cases C-335/21, C-922/19 and C-628/17 and Council of State, judgments no. 6998/2022 and 7535/2021).

Google, in confirmation, cited the results of the fact-finding survey on big data conducted in 2018 by the AGCM itself, the Privacy Guarantor and AGCOM, from which it emerged that the majority of consumers are fully aware of the fact that:

(i) by surfing the Internet, users produce data that allow providers to analyze their behavior and make predictions about future behaviors both for advertising purposes and for other purposes;

(ii) by surfing the Internet and accepting the activation of cookies, users authorize online service providers to collect and process their personal data for analysis and predictions about their behaviors both for advertising purposes and for other purposes.

Should the Council of State have doubts about the possibility for the AGCM to ignore the parameter of the average consumer when ascertaining a misleading commercial practice, the appellant requested that the following preliminary question be submitted to the Court of Justice of the European Union

ex art. 267 TFEU:

“whether, in order to assess the existence of a misleading commercial practice pursuant to the national legislation implementing Articles 5, 6 and 7 of Directive 2005/29/EC, the competent authority must take into account the studies produced by the undertaking under investigation in order to demonstrate the inability of its communication to deceive the ‘average consumer’ or can simply ignore them”.

III. On the absence of aggressive practices: violation and false application of Articles 20, 24 and 25 of the Consumer Code, excess of power due to lack of investigation, misrepresentation of fact and law, erroneous assumptions, illogicality and unreasonableness

The AGCM accused Google of having been responsible for an aggressive commercial practice by having provided, when creating the Account, a mechanism for pre-selecting users’ consent to receive personalized ads that conditioned their freedom of choice.

The Authority's conclusions would be incorrect (a) both in terms of the reconstruction of the facts, which would have been clearly distorted (b) and from a legal point of view, given that the AGCM has classified as aggressive a practice that, even if one were to follow the erroneous reconstruction contained in the Provision, would not in any case integrate the requirements of such a case.

As already documented during the investigation, before concluding the Account creation process and, therefore, before even collecting the browsing data of the members, Google repeatedly asked users whether they were actually interested in receiving personalized ads.

The mere "pre-setting" of consumers' consent to the transfer of their data to Google to receive personalized ads would not in any case be sufficient to integrate the extremes of an aggressive commercial practice.

Any lack of information on the effects of the pre-selection would reveal, if anything, the deceptiveness and not the aggressiveness of the contested commercial practice.

The Consumer Code (articles 20-25) and Directive 2005/29/EC (articles 5-9) clearly distinguish misleading commercial practices from aggressive ones, providing that: (i) the former involve conduct capable of "deceiving the average consumer", i.e. confusing him about the actual convenience of a deal, while (ii) the latter affect the "freedom of choice" of the consumer who, even if he perceives that the deal he is concluding is not convenient, still feels "forced" to conclude it.

The provision would have classified as "aggressive" a commercial practice that, even if one were to consider the reconstruction of the facts carried out by the AGCM to be correct (according to which the "pre-selection" would induce users to transfer their data to Google in an "unaware" manner), does not in any case present the legal requirements necessary to constitute a violation of Articles 24 and 25 of the Consumer Code. Consumption.

Where the Council of State had doubts on this aspect, the appellant requested that the following preliminary question be submitted to the Court of Justice of the European Union pursuant to art. 267 TFEU:

“whether the pre-selection of consumers’ consent, freely modifiable by the latter without any consequences or prospect of negative consequences, but accompanied by unclear information regarding the implications of the pre-selection, should be classified as an aggressive commercial practice capable of influencing consumers’ freedom of choice or should instead be classified in the category of misleading commercial practices, i.e. capable of deceiving the average consumer”.

IV. On the quantification of the sanction: manifest violation of the law and in particular of art. 27, paragraphs 9 and 13, of the Consumer Code and of art. 11 of Law no. 689/81 in relation to the decision to impose a punitive sanction and its amount. Excess of power, lack of motivation, misrepresentation of fact and law, lack of proportionality and unreasonableness.

Google's conduct (illegitimately censured by the AGCM) would constitute a single commercial practice, not two separate ones: (i) Google's conducts that are the subject of the measure have a unitary matrix, all pertaining to the methods of acquiring consumer consent; (ii) they concern the same products (the Services); (iii) they relate to a single and identical alleged commercial choice of the consumer (precisely, the provision of consent to the processing of personal data for commercial purposes); (iv) they concern, in terms of time, the same phase with respect to the promotion and placement of the Services.

The material accumulation of sanctions would be possible only “in the presence of a plurality of conducts with structural and functional autonomy” (Council of State ruling no. 6233/2020), while the application of a single sanction is required when the conducts investigated are all “aimed – from a teleological perspective – at achieving the same objective” (Council of State ruling no. 38/2016).

The absence of reports or complaints in the investigation file would demonstrate the limited scope of the effects resulting from the conducts contested to Google and would confirm the absence of significant damage to consumers and such effects, according to the best case law, should be taken into consideration in order to calibrate the judgment of severity of the same, to which the sanction to be imposed should be measured.

The TAR Lazio (similarly to the AGCM) did not even take into account Google's collaborative effort, demonstrated both by the prompt execution of all the required investigative tasks and by the offer to undertake commitments, although legitimately rejected by the Authority.

The duration of the violations erroneously attributed to Google could not exceed the date of communication to the AGCM of the spontaneous implementation of measures in this regard, without taking into account the different issue of the removal of the effects hypothetically already produced in the past, which are non-existent and in any case unproven.

The two sanctions imposed, each equal to the maximum fine, therefore for a total amount of € 10,000,000, i.e. double the maximum fine allowed, in the face of a manifestly unitary conduct, would be completely disproportionate in light of the relevant regulatory paradigms.

The Competition and Market Authority and U.DI.CON. APS analytically counter-argued, concluding for the rejection of the appeal.

In its reply, Google, among other things, highlighted that, if there were any doubts as to the correct reconstruction of the relationship between the legislation on privacy and the legislation on unfair commercial practices – a question on which the EU Court of Justice has not yet ruled – the Council of State, as the court of last instance, would be required to submit to the European judge, pursuant to art. 267 TFEU, a preliminary ruling on the following questions:

“- Are Articles 4(11), 6(1)(a), 7 and 12 of Regulation (EU) no. 2016/679, read in the light of recitals 32 and 42, in regulating the requirements for the consent of data subjects to the processing of personal data and the related methods of acquisition, guarantee the freedom of determination of data subjects with respect to the processing of personal data (also) for commercial purposes, both in its dimension of fundamental right of the person, and, where such consent is a condition for the use of a given service, in its economic dimension, overlapping with Articles 5 et seq. of Directive 2005/29/EC and the corresponding national transposition provisions and absorbing, in this case, the related assessments;

- Whether Article 3(4) of Directive 2005/29/EC and the corresponding national transposition provisions must be interpreted as meaning that, in the presence of conduct relating to the acquisition of data subjects’ consent to the processing of personal data, which is entirely governed by the legislation on the protection of personal data and in particular by Articles 4(11), 6(1)(a), 7 and 12 of Regulation (EU) No. 2016/679, the application of the latter absorbs that of the provisions of Directive 2005/29/EC and therefore prevails over them, precluding independent sanctioning interventions by the national authorities responsible for the application of Directive 2005/29/EC”.

At the public hearing of 12 December 2024, the case was held for decision.

2. With a first, detailed, series of complaints, Google argued the incompetence of the Antitrust Authority under two distinct profiles, namely the transversal and exclusive competence of the Privacy Guarantor and the absence of a consumer relationship.

In particular, with regard to the relationship between the legislation on unfair commercial practices and the regulation of privacy protection, it believed that the latter should be given precedence over the former; it then deduced that the activities covered by the provision would not constitute a commercial decision, as they would not represent the price or consideration of users to access the services offered.

2.1. First, the delicate issue of the actio finium regundorum between the Competition and Market Authority and the Privacy Guarantor in the matter of unfair commercial practices must be examined.

2.1.1. The case law of the Section, also through reference to the case law of the European judge, has already examined the relationship in the said matter between the Antitrust Authority and the sector Authorities, reaching conclusions that the Panel fully shares

European case law and national case law have held that the criterion of incompatibility should be preferred to the criterion of specialty, which would see the competence of the sector Authority prevail, which sees the intervention of the sector Authority possible only when the contested conduct has "specific areas", in the sense that it does not fall within the power of intervention of the Antitrust.

In other words, the incompatibility, with consequent competence of the sector Authority, would exist when the conduct carried out constitutes the object of possible intervention only by the latter, where, if the contested conduct is such as to fall in abstract within the power of intervention of both Authorities, the competence is of the Antitrust, not of the sector Authority.

In particular, the case law of the Section (most recently judgments of 9 July 2024, no. 6077; 5 June 2024, no. 5030 and 5 April 2024, no. 3175, to which reference is also made pursuant to art. 74 c.p.a.) has formulated the following considerations, from which the Panel has no reason to depart:

“ … European case law has clarified that the wording of art. 3, paragraph 4 of the Directive, according to which "In the event of conflict between the provisions of this Directive and other Community provisions regulating specific aspects of unfair commercial practices, the latter shall prevail and shall apply to such specific aspects", applies first and foremost only to the case of conflict between European provisions, and not to the case of conflict between European provisions and national provisions and then essentially has a very limited scope of application, restricted to the case in which "provisions external" to the Directive regulate "specific aspects" of unfair commercial practices, so as to impose "on professionals, without any margin for manoeuvre, obligations incompatible" with those established by the Directive itself. Outside of this case, which does not arise in this case, European legislation does not preclude a national legislation, such as the one in question, according to which the competence to sanction aggressive commercial practices belongs to the Authority generally competent in matters of competition and markets, and not to the specific Authority of the sector” (see for example Council of State, section VI, no. 665 of 2021). In this regard, the teaching of the Court of Justice of the European Union is relevant (section II, judgment of 13 September 2018, no. 54). The Court stated that the notion of “contrast” between consumer legislation and sector legislation does not imply, for its solution, reference to a principle of speciality but rather denotes “a relationship between the provisions to which it refers that goes beyond mere non-conformity or simple difference, showing a divergence that cannot be overcome by means of an inclusive formula that allows the coexistence of both realities, without it being necessary to distort them”.

It follows that "a conflict" exists only when "provisions external to" Directive No. 29 of 2005, regulating "specific aspects of unfair commercial practices", impose "on professionals, without any margin for manoeuvre, obligations incompatible" with those established by the aforementioned Directive. From the above, it is clear that the European Judge believes that the criterion for resolving a possible competition of rules that regulate the contested conduct is constituted not by the "criterion of speciality" but by the "criterion of incompatibility". The Court of Justice therefore decrees the abandonment of the criteria of criminal law origin that are not very compatible with the nature of the rules of conduct contemplated in the two sectors. These, as already underlined, being an expression of the principle of good faith and leaving their complete typification to the specific case, do not lend themselves to an abstract comparison by comparing the cases. In this perspective, the expression "specific aspects" of the unfair commercial practice requires a comparison not between entire sectors or between specific cases, but between individual general and sectoral rules, with the application of the latter only when they contain disciplinary profiles that are incompatible with the general ones regulating unfair commercial practices. It follows that the sectoral legislation will not regulate unfair commercial practices, but conduct that presents aspects of radical divergence with such practices and that a general Antitrust discipline is established on consumer law.

… In terms of division of competence, it is therefore necessary to reiterate the principle according to which the general rule is that, in the presence of an unfair commercial practice, the competence lies with the Competition and Market Authority. The competence of the other sectoral Authorities is residual and occurs only when the sectoral discipline regulates "specific aspects" of the practices that make the two disciplines incompatible (see for example Council of State, Section VI, Nos. 7296 and 4357 of 2019).

It should be reiterated that the Consumer Code and sectoral regulations are fully complementary and can be harmonized: the criterion to refer to for resolving cases in which the contested conduct is subject to competing regulations must be that of “incompatibility” and not that of “specialty”. The aforementioned “criterion of incompatibility” implies that there is an overall divergence of content between the two regulations that does not allow their abstract coexistence …”.

2.1.2. These principles of law are also applicable to the case in question, although the appellant has rightly argued that the privacy regulation constitutes a general regulation, applicable across all sectors.

This consideration, in fact, concerns the correctness of the processing of personal data, which affects every sector of social life horizontally, in order to guarantee the protection of the related personality rights, but does not affect the transparency of information regarding the exploitation of such data for commercial purposes within a consumer relationship.

In other words, the privacy legislation is designed to protect the rights of the personality, not to protect the freedom of the consumer, so that, from this last point of view, it constitutes, for the purposes in question, a sectoral regulation like the others, with consequent application of the principles set out.

In this regard, the Section (see State Council, VI, 29 March 2021, no. 2631) has already had the opportunity to clarify, in relation to other litigation, that "In this case, it is not a question of affirming whether consumer law can or cannot overlap with the right to the protection of personal data, understood as the two "rights" as distinct sectoral categories that are governed by special regulations and therefore not overlapping with each other; on the contrary, what emerges from the activity [Practice a) - misleading] implemented by the two companies is the exploitation, unknowingly for the user, of the data offered by the latter at the time of registration. It is undoubtedly true that the notion of “processing” of personal data, as it emerges from the reading of art. 4, par. 2, GDPR, translates into a very broad scope of referability with respect to the use of the data and that therefore the special EU regulation on the protection of personal data extends its scope of application as far as any form of human or automatic relationship of personal data can reach, however it cannot be considered possible, nor can such a conclusion be drawn from the examination of the GDPR rules (including the “whereas”) and from the guidelines on the matter expressed by the EU Court of Justice, that the scope of application of the special and exclusive regulation (also in the sense that it excludes the application of other disciplines) can be “absolute”.

Such a conclusion would be unreasonable, since every legal science or human behavior (even through automatic mechanisms connected to the use of IT or digital tools) inevitably involves personal data.

Therefore, recognizing the absolute specialty of the sector relating to the protection of personal data would inevitably lead to radically excluding the applicability of any other legal discipline.

Therefore, while maintaining the recognized “centrality” of the discipline deriving from the GDPR and the Privacy Codes adopted by the Member States in terms of the protection of any instrument of exploitation of personal data, it must nevertheless be considered that when the processing involves and involves behaviors and situations governed by other legal sources for the protection of other values and interests (as relevant as the protection of data relating to the natural person), the legal system – first at the Union level and then at the internal level – cannot allow any expropriation of other sector disciplines, such as that, in the case at issue here, of consumer protection, to reduce the protection guaranteed to natural persons”.

2.2. The conduct subject to intervention by the Authority falls within the scope of a consumer relationship and, therefore, constitutes decisions of a commercial nature.

Pursuant to art. 3 of Legislative Decree no. 206 of 2005, the consumer or user is "the natural person who acts for purposes other than any entrepreneurial, commercial, craft or professional activity carried out", while the professional is "the natural or legal person who acts in the exercise of his/her entrepreneurial, commercial, craft or professional activity, or his/her intermediary". The product is "any product intended for the consumer, including in the context of a provision of services, ... supplied or made available for a fee or free of charge in the context of a commercial activity ...".

The object of the investigation carried out by the Antitrust, as highlighted, does not concern the correctness of the processing of personal data (which constitutes the field of intervention of the Privacy Guarantor), but the methods of information on the exploitation of such data for commercial purposes in the context of a consumer relationship.

In other words, what the Authority is contesting is not the violation of a personality right related to the processing of personal data, but the opaqueness and incompleteness of information on the exploitation of personal data for commercial purposes.

Such exploitation is inherent in a consumer relationship in the presence of the phenomenon of the so-called capitalization of personal data, typical of the new economies of digital markets.

The exploitation of personal data, in fact, is configured as a counter-performance of the service offered by the professional, as it has commercial value.

The professional collects the personal data of users and uses them for profiling purposes for third parties with the sale of advertising space and, therefore, with advertising intermediation activities and so on.

In essence, a trilateral relationship is created: the consumer accesses Google services, allowing, unknowingly even if not obligatorily (i.e. in the absence of correct and adequate information: this is the critical profile identified by the Antitrust), the use of their data to Google, which transfers the data to third parties in exchange for payment for advertising.

In other words: consumers access the services offered by Google; Google transfers the personal data subject to profiling in exchange for payment and companies advertise their products for a fee.

Revenues from advertising services, which derive from profiling activities, constitute the main source of Google's turnover and, on the other hand, the appellant itself argued that it is "well known that all online services need to cover their costs" and that, "with the exception of Wikipedia and institutional sites ..., all online services that are not behind a paywall are monetized through advertising".

The main purpose of profiling is precisely to collect personal data and transform them into information to be used for the construction of advertising and sponsorships calibrated to the user's interests, with the aim of making the user purchase a certain product or service.

It is irrelevant that Google would provide services to users even without using the data, given that the opaqueness of information would be instrumental in obtaining the commercial exploitation of personal data, whose patrimonial value emerges clearly, albeit indirectly, as it constitutes the "bargaining commodity" for companies that, for a fee, transmit "personalized" advertisements for each individual user.

Profiling cookies, in this logic, as already highlighted, are aimed at creating profiles relating to the user and are used in order to send advertising messages in line with the preferences expressed by the user while browsing the Internet.

Moreover, as noted by the Treasury defense, it is useful to consider that with the "Guidelines for the implementation/application of Directive 2005/29/EC on unfair commercial practices" of 25 May 2016 and, subsequently, of 29 December 2021, the European Commission, among other things, highlighted that "Personal data, consumer preferences and other user-generated content have a de facto economic value and are sold to third parties".

2.3. The complaint relating to the failure to obtain the prior opinion of the Privacy Guarantor was formulated, with reference to another ruling of the Section (Telepass ruling no. 497 of 15 January 2024) which had ruled on the point, with the final brief, but the same is not contained in the first instance appeal and is only marginally present in the appeal (page 11), so that, due to the prohibition of nova in appeal established by art. 104 c.p.a., the allegation of a defect is inadmissible.

2.4. On the issue of the division of competences between the Antitrust Authority and the Privacy Authority, the appellant has formulated several preliminary questions, with a request for referral to the Court of Justice of the European Union pursuant to art. 267, paragraph 3, TFEU, both in the appeal and in the final brief.

2.4.1. In general, the Panel notes that the purpose of the obligation to make a preliminary reference is to ensure the uniform application of Union law, which would be jeopardized if different interpretative orientations were to consolidate within the various national legal systems.

Therefore, the national judge of last instance is obliged to raise the question of Community preliminary ruling, with the sole exceptions identified by the Court of Justice of the European Union itself in the so-called ruling Cilfit of 6 October 1982, case 283/81, and, more recently, in the so-called Consorzio Italian Management/Catania Multiservizi judgment of 6 October 2021, case 561/19.

The 2021 judgment constitutes a slight evolution compared to that of 1982, given that the exceptions to the obligation to refer are modified and clarified but with substantial confirmation of the conditions for referral.

These exceptions can be summarized as follows:

1) the question is not “pertinent” (according to the wording used in the Cilfit case) or is not “relevant” (according to the wording used in the Catania Multiservizi case);

2) the EU provision in question has already been interpreted by the Court of Justice;

3) there are no reasonable doubts about the interpretation of a EU provision.

The Court of Justice, in paragraphs 40 to 46 of the Catania Multiservizi judgment, with reference to the third exception, also indicated the interpretative criteria to which the national court of last instance must refer in order to conclude on the absence of elements capable of giving rise to a reasonable doubt.

The Court of Justice, Sixth Section, with the order of 15 December 2022, case 597/21, following a further preliminary reference by this Council of State regarding the third derogation hypothesis, ruled as follows:

“Article 267 TFEU must be interpreted as meaning that a national court against whose decisions there is no judicial remedy under national law may refrain from submitting to the Court a question of interpretation of Union law and resolve it under its own responsibility where the correct interpretation of Union law is so obvious that it leaves no room for any reasonable doubt. The existence of such a possibility must be assessed on the basis of the specific characteristics of Union law, the particular difficulties relating to its interpretation and the risk of divergences in case law within the European Union.

The national judge is not required to demonstrate in detail that the other judges of last instance of the Member States and the Court would adopt the same interpretation, but must have developed the conviction, on the basis of an assessment that takes into account the aforementioned elements, that the same evidence is also imposed on the other national judges in question and on the Court”.

The judgment of the Grand Chamber of the European Court of 15 October 2024 (Case C-144/23, Kubera v. Republic of Slovenia), lastly, stated, in point 2), the following principle of law:

“Article 267 TFEU, read in the light of the second paragraph of Article 47 of the Charter of Fundamental Rights of the European Union, must be interpreted as meaning that a national court against whose decisions there is no judicial remedy under national law must state, in the decision rejecting an application for leave to review … containing a request for a preliminary ruling from the Court of Justice on a question relating to the interpretation or validity of a provision of Union law, the reasons why it did not make such a reference, that is to say, either that the question is not relevant for the purposes of resolving the dispute, or that the provision of Union law in question has already been interpreted by the Court, or that the correct interpretation of Union law is imposes with such evidence that it leaves no room for reasonable doubt”.

Indeed, in paragraph 62, the European judge specified that the motivation for the national judge’s decision to be exempted from the obligation to make a preliminary reference to the Court pursuant to Article 267, third paragraph, TFEU must show “either that the question of Union law raised is not relevant for the resolution of the dispute, or that the interpretation of the provision of Union law in question is based on the case-law of the Court, or, in the absence of such case-law, that the interpretation of Union law has imposed itself on the national judge of last instance with such evidence that it leaves no room for reasonable doubt (judgment of 6 October 2021, Consorzio Italian Management e Catania Multiservizi, C-561/19, EU:C:2021:799, paragraph 51)”.

2.4.2. With the appeal, Google – in arguing that, if there were doubts about the correct interpretation and application to the case in question of the rules and legal principles relating to the division of competences between the Antitrust Authority and the Data Protection Authority, the appeal judge would be required, in compliance with the obligations arising from EU law as a "national judicial body, against whose decisions [cannot] be brought a judicial appeal under domestic law", pursuant to and for the purposes of art. 267(3) TFEU, to preliminarily raise preliminary questions to the Court of Justice of the European Union - has formulated the following specific requests for referral to the Court of Justice:

“whether, in order to assess the existence of a misleading commercial practice pursuant to the national legislation implementing Articles 5, 6 and 7 of Directive 2005/29/EC, the competent authority must take into account the studies produced by the company under investigation in order to demonstrate the unsuitability of its communication to deceive the ‘average consumer’ or can simply ignore them”;

"whether the pre-selection of consumer consent, freely modifiable by the latter without any consequences or prospect of negative consequences, but accompanied by unclear information regarding the implications of the pre-selection, should be classified as an aggressive commercial practice capable of influencing consumers' freedom of choice or should instead be classified as misleading commercial practices, i.e. capable of deceiving the average consumer".

The questions raised with the appeal must be considered inadmissible, since with them no real and effective preliminary question can be said to have been raised by Google, nor does it appear to be configurable, that is to say that, in the party's submission, there is no interpretative doubt on the scope of the European rules, while what has been proposed seems to be resolved in an attempt to request the Court of Justice to assess the concrete facts (see, on the subject, Council of State, VI, 13 November 2024, no. 9138).

What Google is asking the Court of Justice to specifically assess is certain aspects of the merits of the case, which are to be considered inadmissible in accordance with the principles expressed by the European Judge.

Indeed, the national judge has the exclusive power to decide the dispute and to assess the facts and the investigative findings (see judgment of 19 March 1964, case 75/63, Unger; judgment of 26 September 1996, case C-341/94) and the national judge is responsible for applying the rules of Community law to the specific case, so that “the Court has no jurisdiction to rule on the facts of the main proceedings, given that such questions fall within the exclusive jurisdiction of the national judge (judgment of 22 June 2000, case C-318/98, Fornasar and others, Rec. p. I-4785, paragraph 32)” (judgment of 16 October 2003, Case C-421/01).

2.4.3. The preliminary question formulated in the final brief, however, concerns the following questions:

“- Whether Articles 4 (11), 6 (1) (a), 7 and 12 of Regulation (EU) No. 2016/679, read in the light of recitals 32 and 42, in regulating the requirements for the consent of data subjects to the processing of personal data and the related methods of acquisition, guarantee the freedom of determination of data subjects with respect to the processing of personal data (also) for commercial purposes, both in its dimension of fundamental right of the person, and, where such consent is a condition for the use of a given service, in its economic dimension, overlapping with Articles 5 et seq. of Directive 2005/29/EC and the corresponding national transposition provisions and absorbing, in this case, the related assessments;

- Whether Article 3 (4) of Directive 2005/29/EC and the corresponding national transposition provisions must be interpreted in the sense that, in the presence of conduct relating to the acquisition of the data subjects' consent to the processing of 9 personal data, entirely regulated by the legislation on the protection of personal data and in particular by Articles 4(11), 6(1)(a), 7 and 12 of Regulation (EU) No. 2016/679, the application of the latter absorbs that of the provisions of Directive 2005/29/EC and therefore prevails over them, precluding independent sanctioning interventions by the national authorities responsible for the application of Directive 2005/29/EC”.

The issue is not irrelevant for the purposes of deciding the dispute and has not yet been specifically addressed by the CJEU which, instead, has clarified the relationship between competition and the protection of personal data in relation to a dominant abuse situation (Meta Platforms judgment of the Grand Chamber, 4 July 2023).

However, the Panel believes that it is exempted from the obligation to refer pursuant to art. 267, paragraph 3, TFEU, given that the interpretation of Union law, in this case, taking into account the same European case law, is imposed on the national judge of last instance with such clarity as to leave no room for reasonable doubt.

In fact, it has already been highlighted how the European judge (judgment of the Second Chamber 13 September 2018) has established the so-called criterion of incompatibility in place of the so-called criterion of of specialty in order to identify the competent Authority, whether the Antitrust Authority or the Sector Authority, in the matter of unfair commercial practices.

In this regard, it should be reiterated that, if, on the one hand, the privacy legislation has a transversal character, as it relates to every sector of the legal system, on the other hand, it is designed to protect personality rights, not to protect consumer freedom, so that, as far as the matter of unfair commercial practices is concerned, it constitutes a sectoral regulation like the others, with the consequent application of the so-called criterion of incompatibility unequivocally established by the European judge.

In other words, as regards the processing of data for the purposes of protecting personality rights, the privacy legislation has a “horizontal” character, extending to every branch of social activity, while, as regards the exploitation of data for commercial purposes, the same legislation has a “vertical” character and is not incompatible with the specific sectoral legislation.

Therefore, as it is rightly stated in paragraph 50 of the contested resolution – given that, in order to protect one of the fundamental rights of the human person, the Privacy Guarantor has the power to apply sanctions for the violation of the obligations provided for therein, while the Consumer Code, in terms of unfair commercial practices, has the task of protecting the consumer from economic choices induced by deceptive and aggressive practices – the right to privacy and the Consumer Code have a different scope of application and pursue distinct interests, integrating in a complementary manner.

In the case in question, no provision on privacy regulates specific aspects of unfair commercial practices, imposing on professionals, without any room for maneuver, obligations incompatible with those established by Directive 2005/29, so that, by virtue of the regulatory framework clarified by the Court of Justice of the European Union itself, the Antitrust Authority must be considered to be undoubtedly competent to adopt the contested measure.

3. The Authority adopted the contested provision, on the basis of a detailed set of reasons, concluding as follows:

“75. Practice a) … constitutes an unfair commercial practice in violation of [articles] 21 and 22 of the Consumer Code: The Company did not provide consumers with information, in an immediate and adequate manner during the creation of the Google ID and, subsequently, when using the services offered and accessing all Google commercial platforms, regarding the collection and use of their personal data for commercial purposes. The consumer is not informed by the Company that the registration and use of the services offered by Google implies a use of his data for commercial purposes by the Professional, with the effect of inducing him to make a commercial decision that he would not have made otherwise.

76. Practice b) … constitutes an aggressive commercial practice in violation of Articles 24 and 25 of the Consumer Code, as it significantly limits the consumer's freedom of choice, causing him to make a commercial decision that he would not have made otherwise, i.e. to automatically transfer his data to Google. In particular, the Professional exercises undue influence over his users, by pre-setting consent to the acquisition and use of their personal data for commercial purposes, not allowing consumers the possibility of expressing their will in a preventive, conscious and autonomous manner regarding the possible transfer of their data for commercial purposes. The consent to the transfer of data is already pre-set by the Company from the stage of creating the account ID as, in the privacy control area in which consent to the processing of one's data for commercial purposes is managed, the settings are pre-selected on the granting of authorization to use the data. Pre-activation determines, in itself, the transfer and use of data by Google, once these are generated, without the need for further steps in which the user can confirm or modify the preset choice. The consumer is therefore not placed in the position of being able to express in advance, freely and specifically, consent to the use of their personal data for commercial purposes. They are therefore obliged to carry out a complex and non-immediate procedure for deactivation in the event that they do not intend to grant any consent to the use of their personal data”.

3.1. The complaints formulated against the finding of the unfair commercial practice under a) are unfounded.

Art. 21 of Legislative Decree no. 206 of 2005, entitled “Misleading actions”, establishes, in paragraph 1, that:

“A commercial practice is considered misleading if it contains information that is not true or, even if factually correct, in any way, including in its overall presentation, induces or is likely to induce the average consumer in relation to one or more of the following elements and, in any case, induces or is likely to induce him to take a transactional decision that he would not have taken otherwise …”:

Art. 22, paragraph 1, of the same Consumer Code, entitled “Misleading omissions”, provides that:

“A commercial practice is considered misleading if, in the specific case, taking into account all the characteristics and circumstances of the case, as well as the limits of the means of communication used, omits relevant information that the average consumer needs in that context to make an informed commercial decision and induces or is likely to induce in this way the average consumer to make a commercial decision that he would not have made otherwise”.

The Competition and Market Authority, in essence, contested Google for not having adequately informed consumers about the possibility that their data could be used to show them personalized ads, so the capitalization of personal data, the result of the Company's intervention through the provision of data and the profiling of the user for commercial purposes, occurred without due awareness on the part of consumers.

The Authority, therefore, sanctioned the conduct with which Google did not clearly provide relevant information, thereby altering the consumer's ability to make an informed decision.

The conduct under investigation is a typical case of unfair commercial practice (which, as seen, includes both misleading actions and omissions), as the Authority highlighted, with an assessment that is not manifestly illogical or based on a misrepresentation of the facts, how, during the creation of the Google account and during the use of various services offered by Google, the professional omitted relevant information necessary for the consumer to make an informed commercial decision, namely to accept that the professional collects and uses his data for commercial purposes.

The Antitrust Authority has clearly explained the reasons why Google does not provide immediate and explicit information to consumers regarding the collection and use of their personal data for commercial purposes by the Company.

On this point, it should be considered that the proceeding Administration has exercised the power conferred upon it by law, having the nature of technical discretion, so that the final assessment is an assessment of merit, not subject to review in itself, but subject to very narrow limits to the judgment of legitimacy, precisely because it is an expression of technical discretion.

Technical discretion, in fact, is censurable in a jurisdictional setting only when its exercise appears ictu oculi to be vitiated by manifest illogicality, unreasonableness, arbitrariness or misrepresentation of the facts or where it is lacking in investigation and motivation.

The Administration, in carrying out the assessments of competence, generally applies concepts that are not exact, but questionable, with the consequence, already highlighted, that only the assessment that, with regard to the concrete situation, is revealed to be manifestly illogical, that is to say that it is not even plausible, can be considered illegitimate and not an assessment that, although questionable on the merits, is to be considered reasonable, or the assessment that is based on a misrepresentation of the facts.

The use of technical evaluation criteria, in fact, in any field, does not always offer unequivocal answers, but constitutes an assessment not devoid of a certain degree of opinionability and, in such situations, the judge's review, being always a review of legitimacy and not of merit, is destined to stop at the limit beyond which the same opinionability of the assessment carried out by the administration prevents the identification of a legal parameter that allows that assessment to be defined as illegitimate (see, ex multis, Cass. Civ., SS.UU., 20 January 2014, no. 1013).

Since the acts in question are subject to review by the administrative judge for defects of legitimacy and not of merit, the administrative judge is not allowed to exercise intrinsic control over questionable technical assessments, as this would result in the exercise by the aforementioned judge of a substitutive power pushed to the point of superimposing his own assessment on that of the administration, without prejudice however to the fact that even on technical assessments the control of reasonableness, logic, coherence and reliability can be exercised in a judicial setting.

The difference between jurisdiction of legitimacy and jurisdiction of merit, in essence, can be identified in the fact that, in the judgment of legitimacy, the judge acts "in second instance", verifying, within the limits of the objections raised, whether the assessments carried out by the competent body are flawed by excess of power due to manifest unreasonableness or misrepresentation of the facts, that is to say whether the same, although questionable, are outside the perimeter of plausibility, while, in the judgment of merit, the judge acts "in first instance", replacing the Administration and directly and again carrying out the assessments due to it, with the possibility, not contemplated by the legal system except for the exceptional and very limited cases of jurisdiction with extended knowledge of the merits pursuant to art. 134 c.p.a., of substituting his own assessment for the Administration's assessment even in the event that the latter, although questionable, is plausible.

In other words, in the jurisdiction of legitimacy, the question to which the judge must answer is not whether or not he agrees with the assessment made by the competent Administration, given that in that case his review would go beyond the administrative merits, but whether or not such manifestation of judgment is abnormal, which, instead, would concretize the defect of excess of power.

In the case in question, the assessments formulated by the Authority and clearly represented with reference to the practice sub a), although questionable, are certainly plausible, so none of the defects of legitimacy deduced can be said to exist in the administrative action.

Nor can it be argued that the AGCM ignored the parameter of the average consumer, because the assessments expressed are also compatible with reference to users who habitually use IT devices and, therefore, are normally informed about the so-called web browsing.

In fact, the fact that the average user who surfs online is aware of the possible use of personal data for advertising purposes does not exempt the professional from the burden of adopting a clear, comprehensive and immediately perceivable information system on the profiling of personal data, especially since it is not unreasonable to believe that the majority of users access the services quickly, without dwelling excessively on the preliminary indications; therefore it is necessary that the information is immediately perceivable, without the need to interpret it or consult further links.

Moreover, with the aforementioned "Guidelines for the implementation/application of Directive 2005/29/EC on unfair commercial practices", the European Commission, among other things, highlighted that:

"Personal data, consumer preferences and other user-generated content have a de facto economic value and are sold to third parties.

Consequently, pursuant to Article 7(2) and Annex I, point 22 of the Directive, if the trader does not inform the consumer that the data he is required to provide to access the service will be used for commercial purposes, this practice may be considered a misleading omission of relevant information”.

3.2. The complaints raised with reference to the practice under b), however, are well-founded.

Article 24 of Legislative Decree no. 206 of 2005, entitled “aggressive commercial practices”, establishes that:

“1. A commercial practice is considered aggressive if, in the specific case, taking into account all the characteristics and circumstances of the case, by means of harassment, coercion, including the use of physical force or undue influence, it limits or is likely to significantly limit the freedom of choice or conduct of the average consumer in relation to the product and, therefore, induces or is likely to induce him to take a commercial decision that he would not have taken otherwise”.

Article 25 of the Consumer Code, entitled “use of harassment, coercion or undue influence”, provides that:

1. In determining whether a commercial practice involves, for the purposes of this chapter, harassment, coercion, including the use of physical force, or undue influence, the following elements shall be taken into account:

a) the timing, place, nature or persistence;

b) the use of physical or verbal threats;

c) the exploitation by the trader of any tragic event or specific circumstance of such gravity as to alter the consumer's ability to evaluate, in order to influence his decision regarding the product;

d) any non-contractual, onerous or disproportionate obstacle imposed by the trader where a consumer intends to exercise contractual rights, including the right to terminate a contract or to change products or turn to another trader;

e) any threat to take legal action where such action is manifestly reckless or unfounded”.

In this case, therefore, the Authority has ascertained an undue conditioning capable of considerably limiting the freedom of choice of the average consumer.

3.2.1. First of all, the complaints raised appear to be acceptable where Google has effectively highlighted how the provision in paragraph 64, in highlighting that "Pre-activation determines, in itself, the transfer and use of data by Google, once these are generated, without the need for this purpose of further steps in which the user can confirm or modify the pre-set choice", has not considered that, before collecting the users' data, Google asked them more than once if they were interested in receiving personalized ads, through pop-ups shown at the beginning and end of the registration process.

In other words, the pre-selection of the available options not only does not involve any direct and immediate transmission of data, but is followed by other steps in which the consumer has the possibility of deselecting the setting that provides for the profiling of data for commercial purposes (see, in this regard, judgments of the Council of State, VI, 2 December 2024, no. 9614 and 29 March 2021, no. 2631).

3.2.2. Furthermore, it must be considered that the pre-setting of consent to the transfer of data to receive personalized advertisements is not suitable to integrate in itself an aggressive commercial practice.

In order to be classified as aggressive, a commercial practice requires a quid pluris that translates into conduct capable of restricting the user's freedom of choice, which, in this case, does not seem to be possible.

The opt-out method instead of opt-in, in the absence of further characteristics, may contribute to the formation of a misleading commercial practice, but cannot assume the significance of undue influence required by art. 24 of the Consumer Code, since the consumer, even through an act of deselection of the predetermined option and placing the flag on a different space, can, even if more difficultly, avoid making the proposed choice.

The lack of information on the effects of the pre-selection, ultimately, is relevant in terms of deceptiveness and, therefore, on awareness, but not in terms of aggressiveness, i.e. on the freedom of choice, of the commercial practice.

The system used by the professional, therefore, appears reasonably suitable to deceive the average consumer, but not to affect his freedom of choice.

3.2.3. In any case, the two contested commercial practices are not characterized by structural and functional autonomy, since, both pertaining to the methods of acquiring consumer consent in relation to the same products, they are related to the same temporal and procedural segment and, moreover, they pursue the identical purpose of processing personal data for commercial purposes.

In relation to the teleological-functional profile, therefore, Google's conduct can be considered unitary, since both contested cases are aimed at issuing consent for the sending of standardized advertising messages.

Hence, the illegitimate application of the material cumulation of sanctions.

4. It follows that the appeal must be partially accepted, with reference to the commercial practice under b), while it must be rejected for the rest, with reference to the commercial practice under a).

5. As regards the quantification of the sanction relating to the practice under a), taking into account in particular the economic conditions of the company, the application of the pecuniary sanction in the maximum amount provided for by art. 27, paragraph 9, of the Consumer Code, for an amount of € 5,000,000.00, appears reasonable and not affected by the alleged defects of legitimacy.

On the other hand, the pecuniary sanction must have a deterrent character and, since the same range (from € 5,000.00 to € 5,000.00) is provided for all companies, it is clear that with respect to legal persons of very significant economic dimensions such as the appellant, dimensions specifically described in the contested provision in paragraph 81, such effectiveness can only be produced if the sanction is applied to the maximum extent.

With regard to the deterrent effect of the sanction, in fact, in paragraph 85, the said provision highlighted that, “in consideration of the extreme seriousness of the practice, also in relation to the specific turnover generated by Google in 2019, the sanction, even if imposed at the maximum statutory level, does not appear to be deterrent”, specifying immediately afterwards (paragraph 86) that “on the other hand … at present, Directive 2019/2161/EU has not yet been transposed into national law, which sets the maximum statutory level of the sanction to be imposed at at least 4% of the annual turnover of the Professional in the Member State concerned”.

It follows, therefore, that the other objections raised regarding the quantification of the sanction are also irrelevant.

6. In conclusion, the appeal must be accepted in part and, consequently, in partial reform of the contested judgment, the appeal proposed in the first instance must be accepted in part, with consequent partial annulment of the contested provision, with reference to points b) and d) of its operative part. The appeal must be dismissed for the remainder.

7. The costs of the two levels of judgment, given the particular complexity, in fact and in law, of the dispute, and considering the overall outcome of the same, can be fully compensated between the parties.

P.Q.M.

The Council of State in the jurisdictional seat, Sixth Section, definitively ruling, accepts in part the appeal in the epigraph (R.G. n. 1618 of 2023) and, consequently, in partial reform of the contested judgment, accepts in part the appeal proposed in the first instance and partially annuls the contested resolution of the AGCM adopted in the meeting of 16 November 2021, with reference to letters b) and d) of the operative part; dismisses the appeal for the remainder.

Fully compensates the parties for the costs of the two levels of judgment.

Orders that this judgment be executed by the administrative authority.

Thus decided in Rome, in the council chamber on 12 December 2024, with the intervention of the magistrates:

Carmine Volpe, President

Luigi Massimiliano Tarantino, Councilor

Oreste Mario Caputo, Councilor

Roberto Caponigro, Councilor, Drafter

Lorenzo Cordi', Councilor

 

 

THE DRAFTERTHE PRESIDENT

Roberto CaponigroCarmine Volpe

 

 

 

 


 
THE SECRETARY