Germany’s competition authority has ruled that Facebook cannot gather and combine personal data across platforms and websites unless users give permission, a decision that could have wide-ranging implications on the company’s ability to target advertising.
“In future, Facebook will no longer be allowed to force its users to agree to the practically unrestricted collection and assigning of non-Facebook data to their Facebook user accounts,” Andreas Mundt, president of the Federal Cartel Office, said in a statement on Thursday.
“The combination of data sources,” the cartel authority said, “substantially contributed to the fact that Facebook was able to build a unique database for each individual user and thus to gain market power.”
Facebook said it disagreed with the ruling and that German authorities had underestimated the competition the company faced in the country. It will have one month to appeal and four months to send remedies to the Federal Cartel Office.
The decision by the cartel authority, known as the Bundeskartellamt in German, allows Facebook to continue collecting data from its services like WhatsApp and Instagram. But the company will not be permitted to link this information to Facebook user accounts unless a user has explicitly consented.
Facebook will be prohibited also from combining data from third-party websites and connecting it with a Facebook account without the voluntary consent of the user, the ruling said.
The company has been able to monitor users’ activity on third-party sites through its “Like” and “Share” buttons, and through a tracking service called Facebook Pixel.
“By combining data from its own website, company-owned services and the analysis of third-party websites, Facebook obtains very detailed profiles of its users and knows what they are doing online,” Mr. Mundt said in a release.
The authority said Facebook’s management of information like this violated data protection rules. “In the authority’s assessment, Facebook’s conduct represents above all a so-called exploitative abuse,” the regulator’s statement said.
Yvonne Cunnane, head of data protection at Facebook in Ireland, and Nikhil Shanbhag, a director and associate general counsel, said in a statement on Thursday that combining information across its services helped protect its users.
“Using information across our services helps us to protect people’s safety and security, including, for example, identifying abusive behavior and disabling accounts tied to terrorism, child exploitation and election interference across both Facebook and Instagram,” their statement said.
“Popularity is not dominance,” they said.