As seen in recent news, cloud and data storage services have piqued the interest of competition authorities and stakeholders raising competition concerns. In particular:

• Which? has launched a collective proceedings damages action against Apple regarding its cloud storage services on Apple iOS devices;
• the European Commission ("EC") has announced dawn raids and requests for information from companies active in the data centre construction sector;
• the earlier Microsoft/Activision merger review considered Microsoft's strength in global cloud gaming services; and
• both the French Autorité de la Concurrence ("Autorité") and the UK Competition and Market Authority ("CMA") recently used their market investigation powers to scrutinise cloud services in their respective jurisdictions.

These activities have arisen against the broader background of ex-ante regulation of digital markets in a growing number of jurisdictions globally, including the EU and, from January 2025, the UK.

Collective proceedings against Apple – iCloud services on iOS devices

On 14 November 2024, Which? announced its launch of a £3 billion opt-out collective damages action against Apple, alleging a breach of UK competition law. Specifically, Which? alleges Apple has abused its dominant position in iOS by self-preferencing its own cloud storage services on Apple iOS devices and tying iCloud services to iOS devices purchased by consumers.  

According to Which?, Apple's conduct has been "trapping" its customers into using iCloud, using technical restrictions to foreclose effective competition from other cloud storage providers, leading to Apple customers being overcharged each year through increasing monthly iCloud subscription fees across its storage tiers.  Which? estimates that individual consumers could be owed an average of £70, depending on how long they have been paying for the services since 1 October 2015.

While this particular action is limited to consumers, Apple's B2B cloud services offering could potentially come under scrutiny in the future and generate more private actions in the courts.

Dawn raids – data centre construction sector

Just days after Which?'s announcement, on 18 November 2024, the EC announced dawn raids at the premises of companies active in the data centre construction sector and formal requests for information being sent to several companies.  The EC has expressed concern that companies in this sector have breached Article 101 of the Treaty on the Functioning of the European Union ("TFEU") by colluding not to compete for each other's employees ("no-poach agreements").  

Through this action, the EC is seeking to tackle two ongoing areas of focus at the same time, as competition authorities globally have also been shining a spotlight on anti-competitive behaviours in labour markets.

Microsoft/Activision merger control

Competition authorities are also using their merger control powers to scrutinise cloud services. Last year, the Microsoft/Activision transaction attracted scrutiny from a significant number of competition authorities globally, including the EC, the CMA, the US Federal Trade Commission and China's State Administration for Market Regulation.  

Several competition authorities raised concerns about the merger, including on the basis of Microsoft's existing strength in the provision of cloud gaming services globally, which they considered would be reinforced by the acquisition of Activision, and could substantially reduce competition in the market.  

The EC conditionally cleared the merger following a detailed Phase 2 assessment, after accepting licensing commitments from Microsoft which would ensure consumers in the EEA could stream, via any cloud game streaming services of their choice, all current and future Activision PC and console games for which they have a license, and allow cloud gaming streaming service providers to let EEA-based gamers stream any Activision PC and console game.

In contrast, the CMA initially prohibited the merger at Phase 2 on the basis of that the remedies proposed by Microsoft would not sufficiently address the CMA's concerns that the merger may be expected to substantially reduce competition in the developing market for cloud gaming services, to the detriment of cloud gaming users.  As the parties submitted a fresh notification based on new deal terms, the CMA eventually cleared the merger at Phase 1 – the transaction went ahead on the basis that Microsoft would not acquire Activision's cloud streaming rights outside the EEA, with conditions that would address the vertical foreclosure risks identified by the CMA in its original review.

CMA market investigation

Just five days after clearing the Microsoft/Activision merger, the CMA launched a market investigation into the supply of public cloud infrastructure services in the UK in Autumn 2023.  The CMA's updated Issues Statement names Amazon Web Services ("AWS") and Microsoft as the largest two cloud providers who are significantly larger than Google, the next largest provider.  

The CMA is exploring the following theories of harm:

• technical barriers make switching and multi-cloud use harder and limit competition between cloud service providers;
• egress fees harm competition by creating barriers to switching and multi-cloud, leading to cloud service providers entrenching their position;
• committed spend discounts raise barriers to entry and expansion for smaller cloud service providers by incentivising customers to concentrate their business with one provider; and
• software licensing practices by cloud service providers restrict customer choice and prevent effective competition.

The CMA's investigation is ongoing and the final report is due in August 2025. It will likely inform future work under Digital Markets, Competition and Consumers Act 2024 powers.

French competition authority's market study into cloud computing

In January 2022, the Autorité launched a market study on competition in the cloud computing sector, issuing its final report in June 2023. The Autorité's focus was on cloud services (any shared service, accessible via the Internet on demand and paid per use) including the underlying infrastructure (notably, data centres). The opinion raised concerns about:

• the strong market position of hyperscalers (AWS, Google Cloud and Microsoft Azure) in France, which could hinder the entry and expansion of other players, particularly as these players already operate established digital ecosystems across many related markets and often impose technical barriers to interoperability with other competing services;
• the complexity of pricing practices, in particular the prevalence of high-value cloud credits which smaller suppliers may not be able to match profitably, and egress fees which create a risk of customer lock-in, making it more difficult for users to switch; and
• practices that disincentivise migration to cloud providers and lead to high switching costs (e.g., restrictive contractual clauses, pricing advantages favouring the incumbent supplier's products and technical restrictions affecting data portability).

The Autorité looked towards the EU Digital Markets Act ("DMA") as a compelling way to remedy these concerns, suggesting that the EC should monitor egress fees, cloud credits and interoperability / portability concerns as part of its designation decisions. It also signalled a desire to use its competition law toolkit to investigate specific competition law breaches by cloud services providers in the future.

Cloud services fall within the scope of the DMA. In particular, the DMA definition of "cloud computing services" is drafted broadly to capture any digital service enabling on-demand administration and remote access, regardless of the specific service model (e.g., Platform-as-a-Service ("PaaS"), Software as a Service ("SaaS") and Network as a Service ("NaaS")). Data storage services provided by data centres may well take the form of cloud computing – where they do, they will fall within the remit of the DMA.

Only cloud computing service providers which are considered to be an important gateway for operators to reach end-users are at risk of having such activities included in any designation. To date, the EC designations relate to other categories of services which were considered higher priority from a policy perspective – in particular operating systems, online intermediation platforms, social networking services, online advertising services, instant messaging, web browsers, video sharing platforms and search engines. However, cloud computing services may well become the focus of future waves of EC designation decisions. If a cloud computing service were to be designated, the provider would be subject to a number of obligations, for example not to use customer data provided or generated, unless the user has consented or such data is appropriately aggregated.

As the UK digital regime lags behind the EU regime, it is likely that – at least initially – the CMA's designations (the first 3-4 of which are expected to conclude in Autumn 2025) will focus on the same activities and operators already subject to the DMA obligations. However, the CMA has already demonstrated an appetite for divergence from the EC in other areas, notably in merger control cases (including in relation to the suitability of remedies in Microsoft/Activision). The outcome of the CMA's ongoing market investigation into cloud computing may prompt the CMA to turn to such services in further designation investigations, in late 2025 and beyond. As a side note, the CMA announced on 22 November 2024 in a provisional report into its mobile ecosystems market investigation that it was minded to prioritise Apple and Google's activities in mobile ecosystems for its first round of designations. The CMA might well decide that it makes sense to broaden the scope of this work to other digital activities. We should have a clearer view on this around January 2025.