In a potentially far-reaching restriction on how Facebook processes user information, Germany’s national competition authority forbade the social media giant from automatically bundling user data collected across its own platforms, like Instagram and WhatsApp, and related third-party sites.
The company has one month to appeal and said it will.
According to Germany’s Bundeskartellamt, or Cartel Office, Facebook's terms and conditions require users to let the company bundle their data from other sites and assign it all to their Facebook user accounts, which it calls anti-competivie and a violation of European data protection rules.
The agency is requiring Facebook to receive users' voluntary consent to bundle data. If not, the data must remain siloed. Facebook can’t exclude users who disagree from the platform.
“In view of Facebook’s superior market power, an obligatory tick on the box to agree to the company’s terms of use is not an adequate basis for such intensive data processing. The only choice the user has is either to accept the comprehensive combination of data or to refrain from using the social network. In such a difficult situation the user’s choice cannot be referred to as voluntary consent,” the agency said.
“We are carrying out what can be seen as an internal divestiture of Facebook’s data,” said Bundeskartellamt chief Andreas Mundt.
“Facebook will no longer be allowed to force its users to agree to the practically unrestricted collection and assigning of non-Facebook data to their Facebook user accounts,” a procedure he said helped build company’s vast personal databases and accompanying market clout.
Facebook’s response in a post titled, Why We Disagree With the Bundeskartellamt, said the agency “underestimates the fierce competition we face in Germany, misinterprets our compliance with GDPR and undermines the mechanisms European law provides for ensuring consistent data protection standards across the EU.”
The company said its apps compete directly with YouTube, Snapchat, Twitter and others in Germany.
In the wake of the EU-wide GDPR framework, it said it had significantly revamped its privacy policies and the information it provides users about their privacy and the controls they have over their information.
And it insisted that pooling information across platforms helps to make them better and to protect people’s safety.
Facebook also questioned the antirust agency’s jurisdiction, noting that the GDPR specifically empowers data protection regulators – not competition authorities – to determine whether companies are living up to their responsibilities.
Antitrust solutions to the increasingly controversial dominance of the biggest internet players has been discussed in the U.S. but not made much headway. Traditionally, antirust cases have been based on cost to consumers but in this case Facebook is a free service.
Here, the German regulator argued that the extent to which Facebook collects, merges and uses data in user accounts constitutes an abuse of a dominant position in that it exploits consumers who use Facebook and impedes competitors who “are not able to amass such a treasure trove of data.”
“This approach based on competition law is not a new one, but corresponds to the case-law of the Federal Court of Justice under which not only excessive prices, but also inappropriate contractual terms and conditions constitute exploitative abuse,” the agency said.
