Germany limits Facebook data push
In a direct challenge to Facebook’s business model, Germany’s competition authority has sharply curtailed how the company may profile people, saying that users could refuse to allow the company to combine their Facebook information with data about their activities on other sites.
The agency, in a novel antitrust argument, said the company had exploited its dominant position in the German market by coercing people into giving up their personal data. The social network’s terms of service, regulators said, had unfairly forced people to make an all-or-nothing choice — between submitting to unlimited data collection by the company or not using Facebook at all.
The practice has enabled the Menlo Park company to collect data about its users’ activities on millions of non-Facebook sites, personal details that helped make the social network a worldwide powerhouse of personalized advertising.
But German regulators ruled Thursday that Facebook would now have to stop automatically collecting and combining that data and instead give German users a choice. They also prohibited the company from merging information from Facebook accounts with data from the users’ accounts on other Facebook-owned services, like Instagram and WhatsApp, without permission.
“Facebook will no longer be allowed to force its users to agree to the practically unrestricted collection and assigning of non-Facebook data to their Facebook user accounts,” Andreas Mundt, president of the Federal Cartel Office, the German competition authority, said in a statement. “The combination of data sources substantially contributed to the fact that Facebook was able to build a unique database for each individual user and thus to gain market power.”
The German ruling comes at a critical moment for Facebook. The company is under intense scrutiny by officials in the European Union and the United States after a series of scandals last year raised questions about how it collects and handles personal information. In the United States, the Federal Trade Commission is investigating whether Facebook’s data-sharing practices violated a 2011 consent agreement prohibiting it from deceiving users on privacy. A decision on that case is expected soon.
Although the German decision affects only about 32 million of Facebook’s more than 2 billion active monthly users, it could have far-reaching implications.
Authorities in Germany and some other European countries contend that Facebook has unfairly used its leverage to freely collect details about users on millions of third-party sites that use tools like Facebook’s “like” and “share” buttons and its analytics service, called Facebook Pixel. In doing so, the German agency’s ruling is advancing a larger antitrust argument: that a tech company’s abuse of its market dominance to amass information about and profile its users can amount to a kind of data coercion.
“The Facebook decision is quite a fundamental decision,” Mundt said in a phone interview. “If we have similar companies creating similar problems, of course, one could take a look at those as well.”
Facebook disagreed with the ruling, saying it is merely popular in Germany, not dominant, and is being unfairly targeted. It also said its ability to use data from beyond its main Facebook site helped both improve services and protect its users’ information.
Facebook added that German regulators had unfairly singled out the company for business practices that are common in the industry.
“All of this should be — and is — a legitimate area of focus for regulators and policymakers around the world,” the company said in a statement. Yet German regulators, the company said, are trying “to implement an unconventional standard for a single company.”
Facebook plans to appeal the decision, a move that must be made in the next month. The ruling does not impose fines on Facebook because the German agency conducted the case as an administrative proceeding, an approach intended to compel companies to change their practices rather than punish them.
For years, Europe has emerged as the world’s leading watchdog of the technology industry, punishing Amazon, Apple, Google and Qualcomm for tax evasion and anti-competitive behavior. Margrethe Vestager, the European Union’s antitrust chief who has clashed with Silicon Valley, argues that regulators must be more wary of a company’s accumulation of data to accumulate power and stifle competition.
European regulators have also been empowered by a tough new EU law, called the General Data Protection, or GDPR, governing how companies and institutions handle people’s personal information. The law allows regulators to fine companies up to 4 percent of their global revenue, or about $2.1 billion in the case of Facebook. Regulators in Ireland and Britain are among those investigating Facebook’s data-handling practices under the new law.
Among other rules, the new European law generally requires companies to obtain a person’s freely given consent before collecting and using their personal information.
German regulators made their ruling under the country’s competition law. But Mundt said Facebook had also violated the EU data protection law by essentially forcing users to agree that the company could freely amass their data — a process he referred to as “involuntary” consent. He added that, while many people understood that Facebook collected data about their activities on the social network, they did not understand that Facebook could collect data about them from millions of non-Facebook sites.