The Bundeskartellamt, Germany’s federal cartel office, issued a ruling today aimed at severely curtailing Facebook’s practice of combining user data from multiple sources, both inside and outside of the social network’s family of applications.
Today’s ruling is the culmination of an investigation that began in March 2016.
Facebook has 30 days to appeal the decision to the Düsseldorf Higher Regional Court, and it will do just that, according to a Newsroom post by Facebook Ireland head of data protection Yvonne Cunnane (the company’s European headquarters is in Dublin) and director and associate general counsel Nikhil Shanbhag.
Anticipation of this ruling was likely a factor in Facebook’s plans to unify the infrastructure that powers Facebook Messenger, WhatsApp and Instagram Direct.
The Bundeskartellamt said in its ruling that in order to use Facebook and its family of apps, people must agree to the precondition that user data can be collected from outside of its platform and assigned to their accounts. That data comes from Facebook-owned apps such as WhatsApp and Instagram, as well as from third-party websites through technologies such as tracking pixels and social plugins.
The German regulator said users must be given the option of voluntarily consenting to such data collection, or Facebook must curtail these practices, and it sought proposals and solutions from Facebook along these lines.
Bundeskartellamt president Andreas Mundt said in the ruling, “The combination of data sources substantially contributed to the fact that Facebook was able to build a unique database for each individual user and, thus, to gain market power.”
Facebook countered that its current means of data collection is aimed at providing a unique experience across its platform for each user and protecting people’s safety and security.
Marc Al-Hames, general manager of German data protection technology developer Cliqz, agreed with the ruling but suggested that the regulator may be missing out on a bigger target.
He said statistics from Cliqz and its Ghostery anti-tracking software product showed that one out of four website visits are monitored by data trackers from Facebook, but the social network is only No. 2 when it comes to these activities, Google’s Alphabet being No. 1.
The Bundeskartellamt pointed out in its ruling that Facebook and its family of apps have a market share of over 95 percent of daily active users in Germany, with 23 million, and more than 80 percent of monthly active users, with 32 million.
Al-Hames agreed, saying, “Just look at WhatsApp: It’s simply indispensable for many young people today. This is where conversations and friendships are happening. If you want to be a part of it, you have to join. Social media creates social pressure. And Facebook exploits this mercilessly: Give me your data or you’re an outsider. That’s clearly an abuse of a dominant market position.”
Cunnane and Shanbhag responded by stressing that popularity does not equal dominance, citing a Bundeskartellamt survey that found that more than 40 percent of Germany’s social media users do not use Facebook and adding that it faces “fierce competition” from other platforms such as Twitter, Snapchat and YouTube.
Finally, the Bundeskartellamt said in its ruling that Facebook’s data collection methods violate data protection rules in Europe, which the social network strongly disagreed with, noting many changes it made to the controls people have over their information in order to comply with the European Union’s General Data Protection Regulation (GDPR), which took effect last May 25.
Cunnane and Shanbhag wrote, “The GDPR specifically empowers data protection regulators—not competition authorities—to determine whether companies are living up to their responsibilities. And data protection regulators certainly have the expertise to make those conclusions.”
They continued, “The GDPR also harmonizes data protection laws across Europe, so everyone lives by the same rules of the road and regulators can consistently apply the law from country to country. In our case, that’s the Irish Data Protection Commission. The Bundeskartellamt’s order threatens to undermine this, providing different rights to people based on the size of the companies they do business with.”