Big tech: major cloud providers in the firing line?

The UK Competition and Markets Authority (CMA) is already conducting a market investigation into cloud service providers, including Amazon and Microsoft. On 1 January 2025, it gained extensive new powers under the Digital Markets, Competition and Consumers Act 2024 ("DMCC Act"). We look at whether these developments could lead to tougher regulation of major players in cloud services and what that would mean for their customers.

NOTE: On 28 January 2025, the CMA published its provisional decision in its cloud services market investigation. It has reached the provisional conclusion that competition in the market is not working as well as it could be. It found that both Microsoft and Amazon Web Services, the two largest players, have significant market power which makes it harder for alternative cloud suppliers to enter and limits customers' choice of suppliers. It also found that Microsoft is using its strong position in software to make it harder for customers to switch to alternative cloud providers, such as Google and Amazon Web Services, or to use multiple clouds. It recommends that the CMA should use its powers under the Digital Markets, Competition and Consumers Act 2024 to consider whether to designate the two largest providers, Microsoft and Amazon Web Services, as having Strategic Market Status in relation to cloud services (which would allow the CMA to regulate them more easily). The CMA will now consult on the provisional decision. It is expected to make a final decision before 4 August 2025.

Now Reading

What's the concern about cloud services?

Based on the CMA's ongoing market investigation into cloud services, it appears that some businesses find it difficult to switch between some of the larger cloud service providers – with the result that competition in the market may be less intense than it otherwise would be. There are also concerns about businesses finding it difficult to use the services of two different cloud providers alongside one another. This could, for example, make it difficult for a customer which mainly uses Microsoft to engage a service provider which mainly uses Amazon (and vice versa) - particularly where the customer's system and the service provider's system need to interact with one another.

Regulation of big tech in the DMCC Act

The DMCC Act introduces a new regime intended to regulate very large players in digital markets. This will allow the CMA to designate certain firms as having "Strategic Market Status" (SMS). The first SMS designations are not expected to be finalised until September 2025 at the earliest – although we should know the first two areas where the CMA is considering for designation early this year. Indeed, the CMA has recently begun the process of considering whether Google should be designated as having SMS status in relation to its position in search and search advertising services. Once designated, the CMA can impose certain 'conduct requirements' on the relevant firms - the first of these are expected to be imposed at the same time as the first SMS designations. These could include bespoke obligations – in relation to particular services where the CMA has concerns - to ensure that users are treated fairly and are able to interact, directly or indirectly, with the SMS firm on reasonable terms.

A key question is whether these powers will be used to designate major cloud service providers such as Amazon or Microsoft. Some service providers and customers might welcome such a development on the basis that it could impose constraints on the commercial freedom of these very large players.

Will the CMA use the DMCC Act to tackle cloud services?

The DMCC Act is certainly one tool in the CMA's armoury, should it decide that constraints on cloud service providers are justified. However, the European Commission has not yet sought to regulate any cloud service under its Digital Markets Act (DMA), the equivalent of the UK's new digital regime, which came into effect in 2023. This was reportedly on the basis that the relevant firms don't yet meet the DMA's user thresholds for creating a presumption that they should be designated. See pages 17-18 of this briefing for more background on the DMA – and see textbox below for more discussion of firms identified as having "gatekeeper" status (similar to SMS status) under the DMA.

The CMA's likely approach

Under the DMCC Act, the CMA will have greater flexibility than the European Commission has under the DMA to choose the firms and services it wants to regulate. But, while it is safe to assume that Google, Apple, Meta and likely Amazon will soon be regulated under the DMCC Act, it's not yet clear whether cloud services will be in the first wave of digital markets to be targeted. The CMA has stated it will initiate 3 or 4 SMS investigations in the first year, which will likely focus on sectors it has already investigated under its competition/antitrust powers – such as mobile browsing, mobile ecosystems, or app stores (and as noted above, it has already launched an SMS investigation into Google's position in search and search advertising). The CMA does have a competition market investigation into cloud services already on foot (using its existing powers) and has already suggested that one outcome from that could be to recommend that cloud services be regulated under the DMCC Act. But the CMA may wish to complete that investigation – not due to conclude until Summer 2025 – before taking any action under the DMCC Act. That could also help ensure that the CMA's first designations do not create major divergence with the DMA in the EU.

The EU's approach

Amazon and Microsoft have been identified as having "gatekeeper" status under the EU's Digital Markets Act - but in respect of the following core platform services ('CPSs') (not in respect of their cloud services):

Amazon: Amazon Marketplace (online intermediation services) and Amazon Advertising (online advertising services)
Microsoft: LinkedIn (online social networking services) and Windows PC OS (operating systems)

Google has also been given "gatekeeper" status by the EU in relation to numerous CPSs, including Google Search (search engine) and the Android mobile (operating system) – but not cloud services (although it has a significantly lower market share than either Amazon or Microsoft in cloud services).

The EU's Data Act will also bring in measures in September 2025 to facilitate switching and porting of data between cloud service providers and parallel use of multiple cloud services, as well as to gradually phase out switching charges (for more detail, see pages 7-9 of this briefing). The EU could take the view that these measures will be sufficient to address current concerns about switching between cloud service providers – and that as a result, intervention under the EU Digital Markets Act is not required, at least in the short term.

What other action could be taken?

Even if it decides not to use its powers under the DMCC Act, the CMA could take action following its market investigation into cloud services; for example, it could order cloud providers to change some of their software licensing practices. However, the investigation is still ongoing and the CMA would first have to be satisfied that the behaviour of certain providers was having an adverse effect on competition in the market. The CMA is currently expected to publish its final decision in July 2025, although it is hoped that we will know its provisional decision in early 2025.

What does this mean for customers of cloud service providers?

At present, there is typically very little room for significant negotiation of the terms offered by cloud service providers. It remains to be seen whether the CMA's scrutiny will force changes in this respect. For example, if concerns about difficulties switching between providers are borne out, the CMA could look at imposing requirements on cloud service providers to make it easier to inter-operate with other, competing services. Similarly, if the CMA concludes that egress fees are problematic, it could look at imposing caps. Until it has concluded its investigation, however, none of these are on the table - so some customers may prefer to wait until the CMA has reported before entering into new deals with major cloud service providers (the current timetable indicates that the CMA expects to publish its final decision in July 2025 – although its provisional decision is expected in January 2025, which should provide a reasonable indication of its thinking on cloud services). Others may wish to bear in mind that the CMA's interest in this market means that now is a sensitive time for cloud service providers, who are unlikely to want their customers to be complaining to the CMA about how they are being treated. It's possible that this may give some customers more leverage than they would normally have when negotiating with major players in this market.

The broader picture

The CMA is also likely to take account of other recent or ongoing developments in the application of competition law to cloud services, such as the examples highlighted below.

Cloud services: what else is happening?

Alongside the CMA's market investigation into cloud services, there have been a number of other developments in this space, including:

The collective action being brought by Which? against Apple for allegedly putting unjustified barriers in the way of consumers using cloud services other than its own iCloud offering;
The 2023 market study conducted by the French Competition Authority (Autorité de la Concurrence) into cloud services, which highlighted similar concerns about competition in the market; and
Competition investigations relating to other cloud-based services, such as gaming (notably the CMA's ongoing investigation into cloud gaming (together with mobile browsers) and the various merger decisions taken in relation to Microsoft's acquisition of Activision (which also looked at the cloud gaming market).

These developments could affect the CMA's approach to more technical issues such as market definition – or they could affect its broader, strategic approach. For example, the CMA could ultimately take the view that, since customers could potentially bring their own private damages actions against cloud service providers – as Which? is doing on behalf of Apple users – its focus as a regulator would be better directed towards tackling problems in other markets. However, as things stand, the evidence strongly suggests that the CMA continues to regard cloud services as an area that merits scrutiny using its competition law powers.

How we can help

The wave of new regulation and enforcement activity aimed at the tech space in both the UK and EU presents both risks and opportunities. Successfully navigating this challenging environment requires expertise across numerous complex areas of law, including competition, data, digital services, cybersecurity and AI. Our Competition and Technology and Commercial Transactions teams regularly work closely together to provide a holistic, coordinated approach. This combines extensive knowledge of specialist legislation and how regulators think with a deep understanding of the sector and a keen awareness of the wider picture.

Read Stephen Whitfield Profile