What is the “combination” of data under the Digital Markets Act?

In law, the choice of words matters, and a given interpretation can mean the difference between a behaviour being permitted or prohibited. When some recently claimed that the Cologne Higher Regional Court might have misinterpreted one of the European Union’s newer data-related acts, the Digital Markets Act (DMA for short), the challenge to the judges’ interpretation was based on the meaning of one particular verb: to “combine”. That claim piqued my interest – and ultimately led to this critical analysis.

The context is that of Article 5(2) of the DMA, which lists various business practices that the DMA prohibits in the absence of consent of the end-user.

The business practice in question? The situation in which a “gatekeeper” under the DMA “combine[s] personal data from the relevant core platform service with personal data from any further core platform services or from any other services provided by the gatekeeper or with personal data from third-party services” (Art. 5(2)(b) DMA). A “core platform service” is one of those listed by the European Commission on its DMA “gatekeeper” list.

The stakes can be very high for gatekeepers (and those who work with gatekeepers in this context), as this is a business practice that non-gatekeepers can in theory carry out without consent being the imposed legal ground. After all, as this concerns the processing of personal data, an assessment of legal grounds under the GDPR will be needed (for processing activities that fall within the scope of the GDPR), and consent is just one possible legal ground under Article 6 of the GDPR (as well as Article 9 GDPR, if that applies).

In fact, these are scenarios in which non-gatekeepers would (based on my own experience) not usually rely on consent but on “contract” or “legitimate interest” as a legal ground under Article 6 of the GDPR. This suggests that consent might not be realistic or the most appropriate legal ground for data processing in those scenarios.

A broad interpretation of the verb “to combine” in this context, therefore, means blocking gatekeepers from carrying out a range of business practices that others can do in a freer manner.

How then has it been interpreted, and what is it supposed to mean?

---

1. What “combine” means, according to the Cologne court

The Cologne Higher Regional Court (the Oberlandesgericht Köln – the Cologne HRC) delivered on 23 May 2025 a judgment (in German) in a case relating to Meta’s plans to use certain (public) Facebook and Instagram content to train its AI models. A plaintiff had sought an injunction to prohibit that use, and the Cologne HRC found that Meta’s plans were lawful under the GDPR. [For a more in-depth analysis, see my article on the topic: Good & bad in judgment on Meta AI training & personal data (legitimate interests, sensitive data) + new French & German guidance]

One section of that judgment related to the DMA and specifically the issue of whether the act of placing Facebook and Instagram data together, without specifically linking it together in relation to the plaintiff, counted as a combination of personal data under Article 5(2)(b) DMA.

In other words: is the juxtaposition of two datasets containing personal data the act of “combining” personal data specifically regulated by Art. 5(2)(b) DMA?

The judges clearly took the view that no, this is not what Art. 5(2)(b) DMA covers, as there is no linking of the personal data of one user from one dataset with the personal data of the same user from another dataset.

In paragraph 44 of its judgment (in section 2(b)(aa)), the Cologne HRC states that “the incorporation of partially de-identified and disaggregated data from two central platform services into an unstructured training data set for an AI […] is not a combination within the meaning of [the DMA]. There is no targeted linking of personal data of a user from one central platform service with personal data of the same user from the other central platform service” (emphasis mine; rough translation).

In other words, because the data from a core platform service is used in parallel with other data (e.g. data of one person from core platform service 1 might appear in the training data set just like data of that same person from service 2) but not combined to form one larger set of data regarding one individual (so no matching to build a “core platform service 1 + service 2” combination by way of the AI training process), the DMA’s prohibition does not apply here. It just isn’t a combination of the data – it’s a mere juxtaposition.

The Cologne HRC considered that data “combination” would need to involve “a targeted connection of data from the same person” (para. 47; rough translation).

Paragraph 48 explains this further: “[…] a “merging” of data can only be assumed in the case of their connection in the context of user profiles, but not in the case of their – as here – unassigned and even de-identified contribution to a uniform “data silo”. Only the former understanding explains the possibility of the users concerned to consent to the merging […] [Art. 5 para. 2 DMA] assumes that an end user consents to the merging of data from multiple sources and that the merging is then lawful. This also shows that the provision is tailored to the case of the targeted linking of data from one and the same user.” (rough translation)

The Cologne HRC also relied on a particular passage from a DMA decision of the European Commission – so it’s worth looking at that too.

---

2. What “combine” means, according to the European Commission

On 23 April 2025, the European Commission adopted its DMA decision in relation to Meta’s offering of a subscription model for no ads (the “SNA” approach as described in that decision) regarding Facebook and Instagram.

In this DMA decision regarding Meta, the Commission repeatedly focusses only on the combination of data regarding a same user, i.e. matching.

Paragraph 30 of that DMA decision states the following: “a gatekeeper is prohibited from combining the personal data of end users from one of its CPSs with the personal data of those end users from its other CPSs or distinct services, or with personal data of the same end users from third party services” (emphasis mine)

Similarly, in paragraph 175, the DMA decision reads as follows: “Article 5(2) of Regulation (EU) 2022/1925 refers to Article 4, point (11), and Article 7 of Regulation (EU) 2016/679 to define the consent that the end user must give the gatekeeper to process, combine, or cross-use his or her personal data across the gatekeeper’s CPSs and distinct services.” (emphasis mine)

[Paragraph 234 contains nearly identical wording.] 

The Commission also refers to the requirement “that end users have given valid consent to the combination of their personal data” (paragraph 177) when explaining the conditions included in Article 5(2) DMA, and repeatedly speaks simply of “the combination of their personal data” (paragraphs 179 & 202).

Each of those excerpts clearly implies only one possible view: both the first set of data and the second set of data being combined relate to the same identifiable natural person.

---

3. A contrary view?

In a blog post of 21 July 2025, Lena Hornkohl and Alba Ribera Martínez set out a case for another interpretation, one drawn from the DMA’s “ core objective of fostering “fair and contestable” digital markets and the competition-akin nature of the provisions”. The Article 5(2) DMA prohibition of data combination, according to the authors, “also aims to address the gatekeepers’ enhanced access to personal data of end users, which gives gatekeepers advantages in terms of data accumulation, thereby raising barriers to entry of markets where contestability is already impaired”.

The authors further state as follows regarding the Commission’s DMA decision regarding Meta:

“On the contrary, one has a hard time concluding from that paragraph [of the DMA decision], as the Court does, that the data combination under Article 5(2)(b) DMA must concern data relating to the same (i.e. individual) person. The Commission uses the plural form “end users,” referring to a group of persons, when stating: “a gatekeeper is prohibited from combining the personal data of end users from one of its CPSs with the personal data of those end users from its other CPSs or distinct services, or with personal data of the same end users from third-party services.” This wording indicates that, while the data must relate to the same end users across services, it can concern multiple end users simultaneously. There is no requirement for a one-to-one linkage of data from a single end user. Had the Commission intended such a narrow interpretation, it would likely have used the singular form instead in that paragraph. Similarly, the requirement of a targeted linking of data relating to the same person cannot be found in para 96 (or elsewhere) in the commentary that the Commission relies on.”

It is an interesting teleological approach, but one with which I am inclined to disagree, for various reasons.

---

4. Why legal interpretation principles and Article 5(2) DMA itself exclude a broad interpretation of the “combine” provision

The prohibition of data combination without consent under Article 5(2)(b) DMA cannot be viewed in a vacuum. Principles regarding the interpretation of laws, coupled with certain conscious choices of the EU legislator, run counter the approach I quoted in section 3 above. Instead, I consider that they support the view of the Commission in the DMA decision regarding Meta and that of the Cologne HRC in its judgment.

4.a) Cross-use vs combine: genesis

First, there is the distinction to be drawn with other parts of Article 5(2) DMA – specifically, the “cross-use” prohibition.

Article 5(2)(c) DMA prohibits the practice whereby a gatekeeper “cross-use[s] personal data from the relevant core platform service in other services provided separately by the gatekeeper, including other core platform services, and vice versa” if there is no consent from the end user.

Recital 36 of the DMA explains the “other services provided separately” part further, stating that this “notably” overs “services which are not provided together with, or in support of, the relevant core platform service”.

This “cross-use” provision appears to be in part a response to civil society feedback. In a letter of 25 January 2021, Johnny Ryan, Senior Fellow at the Irish Council for Civil Liberties, asked the European Parliament to add to the then draft DMA a “cross-use” provision to avoid situations where there might not be any combination of personal data – which the Parliament then proceeded to do.

4.b) Need for a strict interpretation

As it turns out, this “cross-use” provision provides a good illustration of the fact that the business restrictions in Art. 5(2) DMA have to be interpreted strictly.

After all, based on its genesis and Johnny Ryan’s letter, “cross-use” is about limiting repurposing, i.e. processing of personal data for other purposes/services than those (compatible with those) for which the personal data was collected.

Recital 36 of the DMA makes this clear: consent is needed if personal data from one core platform service is used for a service that is different and not provided together with, or in support of, that core platform service.

Yet any grouping of data (whether a “combination” in the sense of matching or a mere juxtaposition) could be viewed as repurposing, as the use of that data for a wholly different service.

In other words: under an expansive interpretation of “cross-use”, “combine” would be irrelevant. There would be no need for the “combine” provision if Art. 5(2) DMA business restrictions have to be interpreted broadly.

This is where general principles regarding the interpretation of laws come into play. One of the key principles there is that every provision must have a purpose. Despite any misgivings one might have in that respect (perhaps everyone has one or two laws they find ridiculous?), one must always assume that the legislator knows what it is doing and that no law, but also no provision within a law, is without object or purpose.

For Art. 5(2)(b) DMA to have any purpose, Art. 5(2)(c) DMA must therefore be interpreted strictly. Yet the strict interpretation of one of Art. 5(2) DMA necessarily means that the others must also be interpreted strictly. Any other approach would make the law in general, and the DMA in particular, wholly unpredictable.

Put differently: the fact that Art. 5(2)(c) DMA cannot be interpreted broadly also means that Art. 5(2)(b) DMA cannot be interpreted broadly.

This logic is further supported by several other general principles of law, those of legal certainty, of legitimate expectations and of proportionality, which are notably found in Article 52 of the EU Charter of Fundamental Rights. It bears stressing in this respect that the business restrictions in Art. 5(2) DMA are in and of themselves a statutory limitation on the freedom to conduct business, a fundamental freedom under Article 16 of the EU Charter. Article 52 of the EU Charter states that any limitation on the exercise of that freedom (or any other right or freedom under the EU Charter) is subject to “the principle of proportionality”, must be “necessary” and must be “provided for by law”. In turn, that last point requires (as per case law of the EU Court of Justice predating the EU Charter) that legal rules must be “clear and precise” as well as foreseeable (see notably CJEU, 15 February 1996, Duff and Others, C‑63/93, EU:C:1996:51, paragraphs 19 & 20, regarding the principles of legitimate expectations and legal certainty).

The tying of “provided by law” with necessity and proportionality shows that any limitation to a fundamental freedom (or right) must be interpreted strictly.

In that regard, absent any clear indication in the DMA Recitals or in the provisions themselves regarding any broad scope, Art. 5(2)(b) (and (c)) DMA cannot be interpreted broadly.

4.c) Impact of the consent requirement

The reasoning above shows that a strict interpretation is needed, which already helps. After all, an interpretation of “combine” as “juxtaposition” rather than “matching” is a broader interpretation.

Yet it is not yet the end of the reasoning, as one must also look at one more aspect, namely the (in my view significant) impact of consent.

It is worth recalling that Art. 5(2) DMA prohibits certain business practices unless the end user has given consent thereto. Without consent, no cross-use. Without consent, no combining.

That requirement of consent, however, appears nonsensical if the purpose of the “combine” provision is to prevent the mere juxtaposition of data.

This is best illustrated by explaining what that would entail.

Let us say that the personal data of persons A.B., C.D. and E.F. appears in the dataset of a gatekeeper’s core platform service.

Under the broad interpretation (the “contrary” view explained above), consent of the end user would be needed under Art. 5(2)(b) DMA in order to place the data of A.B., C.D. and E.F. alongside other personal data from persons G.H., I.J. and K.L. stemming from another service.

“End user” in turn is defined under Article 2(20) DMA as “any natural or legal person using core platform services other than as a business user”.

This creates an odd situation, as this broad interpretation of “combine” leads to the requirement to have the consent of only A.B., C.D. and E.F. (as users of the core platform service) but not G.H., I.J. and K.L.

G.H.’s personal data is also being used, but that is no matter – no consent is required in that respect.

Yet what is the meaning of this consent? In the case of a mere juxtaposition (not matching), the only purpose of that juxtaposition will be to identify patterns, i.e. to go to a higher level of abstraction, away from the individual. In practice, therefore, the broad interpretation can only mean that consent is being required for the deriving of aggregated data – in which case, the distinction between users of core platform services and users of other services appears absurd. After all, if nothing is being derived at an individual level, (i) why require consent at all for core platform users if the purpose is precisely to go away from the individual, and (ii) even if there were a justification for consent in that case, why not be consistent and require it for the other users whose data is also being used for the deriving of aggregated data?

If the stricter interpretation of Art. 5(2)(b) DMA is followed, this odd scenario disappears altogether: consent of A.B. is needed in order to perform a combination (= matching) of data of A.B. from the core platform service and data of A.B. from the other service; same thing (separately) for C.D. and for E.F. In that case, any data concerning G.H., I.J. and K.L. remains unaffected by the combination process and is irrelevant if they are not themselves users of the core platform service. The consent requirement makes sense, as the matching is a separate processing activity that derives additional insights in relation to a given natural person.

4.d) Practical issues in case of a broad interpretation

In addition, a broad interpretation of “combine” under Art. 5(2)(b) DMA would raise serious practical difficulties. If “combine” means “juxtaposition”, i.e. placing two datasets together without any attempt to link them, what exactly is a “combination” – and more importantly, what is not? Where is the technical limitation? Is the mere hosting of data on a same server infrastructure the “combination” (read in that context: “juxtaposition”) of data that requires consent? What if someone working on database maintenance happens to have two browser windows open on two screens, one concerning the core platform service and one concerning the other service – is that a “combination”?

These may seem laughable suggestions at first glance, but they should not be dismissed under any circumstances. If the verb “to combine” is interpreted broadly to cover the mere juxtaposition of datasets, and does not involve the actual linking of personal data of one individual across the two datasets, then consent becomes required for a wide range of technical operations – while it would be absurd to require consent in such cases.

Once again, those problems disappear altogether if the combining of personal data is taken to mean only “matching”, or as the Cologne HRC put it, the “targeted linking of personal data of a user from one central platform service with personal data of the same user from the other central platform service” (rough translation).

4.e) What of the plural “end users” in the Commission’s DMA decision?

In the blog post quoted above, a suggested reading of para. 30 of the Commission’s DMA decision in relation to Meta is that “while the data must relate to the same end users across services, it can concern multiple end users simultaneously. There is no requirement for a one-to-one linkage of data from a single end user. Had the Commission intended such a narrow interpretation, it would likely have used the singular form instead in that paragraph”.

I disagree with this interpretation of the Commission’s wording (worth repeating: “a gatekeeper is prohibited from combining the personal data of end users from one of its CPSs with the personal data of those end users from its other CPSs or distinct services, or with personal data of the same end users from third party services” – emphasis mine).

It is true that the Commission could have written the following: “a gatekeeper is prohibited from combining the personal data of any end user from one of its CPSs with the personal data of that end user from its other CPSs or distinct services, or with personal data of the same end user from third party services”

However, the interpretation proposed – that because it is plural, it cannot have been the Commission’s intention to cover targeted combinations at an individual level – is in my view linguistically incorrect because the Commission did not use an article before the first instance of “end users”. It wrote: “combining the personal data of end users”, not “combining the personal data of the end users” or “combining the personal data of [dozens/hundreds/…] of users”.

In English, the absence of an article (also called the “zero article”) in front of a plural noun transforms that into a generalisation.

In other words, the Commission’s absence of an article in front of that first “end users” means that it could be any number of end users.

The definite articles that follow (“those end users”, “the same end users”) are entirely logical in that context, as they are a means of referring to whatever collection (from one to many) of end users is referred to initially.

---

5. Conclusion: “combine” means data matching, not the mere juxtaposition of datasets

Put it all together, and it forms a consistent whole:

• The introduction of the “cross-use” provision in Art. 5(2) DMA could have covered the combination of data if the term could have been interpreted broadly.
• Given the introduction of “cross-use”, “combine” itself cannot either be interpreted broadly.
• In any case, these are limitations to Art. 16 of the EU Charter.
• Such limitations must be provided by law (legal certainty) and must be foreseeable (legitimate expectations), and must be necessary (strict interpretation).
• A broad interpretation, whereby “combine” also covers situations of simple juxtaposition of data sets without actual linking at an individual level, would run counter these requirements.
• In addition, the consent requirement creates odd situations if a broad interpretation is used, both in terms of discrimination between core platform service users and other users and in relation to technical operations.
• If “combine” is read as “match” (targeted linking of data from one user from a service with data from the same user from another service), these issues all disappear.

As I mentioned in a previous article, I have serious doubts as to the Commission’s legal reasoning in its DMA decision in relation to Meta (see part 1 and part 2 of my critical analysis), but on this particular point I agree with the Commission (and the Cologne HRC) as regards the reading one should make of Article 5(2) of the DMA.

Namely: data combination under Article 5(2)(b) DMA must be interpreted as meaning the actual matching of data regarding individuals. It is not about the mere juxtaposition of datasets but requires an active linking of personal data at an individual level, no matter the precise number of individuals concerned.

It’s not the only part of Article 5(2) DMA that merits discussion though. Cross-use is another one, as does the scope of end user consent in the context of its “vice-versa” wording. But that’s a topic for another time – as that might depend on the outcome of the SRB ruling that the CJEU will hand down on Thursday 4 September. It raises interesting questions regarding the scope of “personal data”, potentially even within a same organisation.

More to come after the SRB ruling then – and be sure to join the LinkedIn Live discussion I am hosting on the day of the ruling (300+ participants and counting).

EDIT: further reading:

• Submission fled in relation to the DMA-GDPR Guidelines proposed jointly by the Commission and the European Data Protection Board, detailing issues these Guidelines present and risks associated with them;
• SRB ruling deep dive + commentary.