Germany's Competition Authority ("the Bundeskartellamt") has imposed far-reaching restrictions in the processing of user data on Facebook.

According to Facebook's terms and conditions, users will need to provide their consent in order for Facebook to collect the user's data outside of Facebook's website, via the internet or on smartphone apps, and to assign such data to the user's Facebook account.

However, according to the Bundeskartellamt's decision, given Facebook's dominant position in the German market for social networks, which is indicative of a monopolization process, Facebook becomes subject to specific obligations under competition law, given that users cannot on a practical level, switch to other social networks. In this regard, an obligatory tick box agreeing to the company's terms of use is not considered an adequate basis for such intensive data processing.

The Bundeskartellamt calls attention to the fact that Facebook collects a massive amount of data from third-party websites with an embedded "Like" button, even if no Facebook symbol is visible. By combining data from its own website, company-owned services and the analysis of third party websites, Facebook obtains very detailed profiles of its users, who have no choice but to consent to this practice.

In accordance with the Bundeskartellamt's decision, the extent to which Facebook collects, merges and uses data in user accounts, constitutes an abuse of a dominant position.

As such, the Bundeskartellamt has imposed the following restrictions on Facebook's processing of user data

  1. Facebook-owned services, such as WhatsApp and Instagram, can continue to collect data. However, such data can only be assigned to Facebook user accounts subject to the users' voluntary consent. Where consent is not given, the data must remain with the respective service and cannot be processed in combination with Facebook data;
  2. Collecting data from third party websites and assigning them to a Facebook user account will also only be possible if users have given their voluntary consent; and
  3. If consent is not given for data from Facebook-owned services and third party websites, then Facebook will have to substantially restrict its collection and combining of data. Facebook is to develop proposals for solutions to this effect.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.