In a direct challenge to Facebook’s business model, Germany’s competition authority on Thursday sharply curtailed how the tech giant may profile people, saying that users could refuse to allow the company to combine their Facebook information with data about their activities on other sites.
The agency, in a novel antitrust argument, said that the company had exploited its dominant position in the German market by coercing people into giving up their personal data. The social network’s terms of service, regulators said, had unfairly forced people to make an all-or-nothing choice — between submitting to unlimited data collection by the company or not using Facebook at all.
The practice has enabled the Silicon Valley company to collect data about its users’ activities on millions of non-Facebook sites, personal details that helped make the social network a worldwide powerhouse of personalized advertising.
But German regulators ruled that Facebook would now have to stop automatically collecting and combining that data and instead give German users a choice. They also prohibited the company from merging information from Facebook accounts with data from the users’ accounts on other Facebook-owned services, like Instagram and WhatsApp, without permission.
“Facebook will no longer be allowed to force its users to agree to the practically unrestricted collection and assigning of non-Facebook data to their Facebook user accounts,” Andreas Mundt, president of the Federal Cartel Office, the German competition authority, said in a statement on Thursday. “The combination of data sources substantially contributed to the fact that Facebook was able to build a unique database for each individual user and thus to gain market power.”
The German ruling comes at a critical moment for Facebook. The company is under intense scrutiny by officials in the European Union and the United States after a series of scandals last year raised questions about how it collects and handles personal information. In the United States, the Federal Trade Commission is investigating whether Facebook’s data-sharing practices violated a 2011 consent agreement prohibiting it from deceiving users on privacy. A decision on that case is expected soon.
Although the German decision affects only about 32 million of Facebook’s more than two billion active monthly users, it could have far-reaching implications.
Authorities in Germany and some other European countries contend that Facebook has unfairly used its leverage to freely collect details about users on millions of third-party sites that use tools like Facebook’s “like” and “share” buttons and its analytics service, called Facebook Pixel. In doing so, the German agency’s ruling is advancing a larger antitrust argument: that a tech company’s abuse of its market dominance to amass information about and profile its users can amount to a kind of data coercion.
“The Facebook decision is quite a fundamental decision,” Mr. Mundt said in a phone interview. “If we have similar companies creating similar problems, of course, one could take a look at those as well.”
Facebook disagreed with the ruling, saying in a statement that the social network was merely popular in Germany, not dominant, and was being unfairly targeted. It also said its ability to use data from beyond its main Facebook site helped both improve services and protect its users’ information.
Facebook added that German regulators had unfairly singled out the company for business practices that are common in the industry.
“All of this should be — and is — a legitimate area of focus for regulators and policymakers around the world,” the company said in a statement. Yet German regulators, the company said, are trying “to implement an unconventional standard for a single company.”
Facebook said it planned to appeal the decision, a move that must be made in the next month. The ruling does not impose fines on Facebook because the German agency conducted the case as an administrative proceeding, an approach intended to compel companies to change their practices rather than punish them.
The German competition authority has been quite active in investigating market competition in the tech sector. Mr. Mundt compared the Facebook ruling to a 2013 case in which his agency charged Amazon with unfairly prohibiting sellers, as a condition of selling their products on the site, from offering lower prices elsewhere. Amazon ultimately agreed to abandon its pricing practice.
The agency is now investigating Amazon’s terms and practices toward third-party sellers in Germany on its site. And for the last year, the regulator has also been conducting an investigation into the online advertising industry, with a particular focus on whether a few large companies are hindering market competition.
Over the last few years, Europe has emerged as the world’s leading watchdog of the technology industry, punishing Amazon, Apple, Google and Qualcomm for tax evasion and anticompetitive behavior. Margrethe Vestager, the European Union’s antitrust chief who has clashed with Silicon Valley, argues that regulators must be more wary of a company’s accumulation of data to accumulate power and stifle competition.
European regulators have also been empowered by a tough new E.U. law, called the General Data Protection, or G.D.P.R., governing how companies and institutions handle people’s personal information. The law allows regulators to fine companies up to 4 percent of their global revenue, or about $2.1 billion in the case of Facebook. Regulators in Ireland and Britain are among those now investigating Facebook’s data-handling practices under the new law.
Among other rules, the new European law generally requires companies to obtain a person’s freely given consent before collecting and using their personal information.
German regulators made their ruling under the country’s competition law. But Mr. Mundt said Facebook had also violated the E.U. data protection law by essentially forcing users to agree that the company could freely amass their data — a process he referred to as “involuntary” consent. He added that, while many people understood that Facebook collected data about their activities on the social network, they did not understand that Facebook could collect data about them from millions of non-Facebook sites.
The ruling prohibits Facebook’s all-or-nothing approach to amassing personal information about its users. It allows Facebook to continue collecting data about people on its own platforms. But it will need permission before collecting data about its users from non-Facebook sites and combining it with their Facebook account data. It will also need permission to combine Facebook user account data with user data on company-owned services like WhatsApp and Instagram.
“We are giving choice back to the consumer,” Mr. Mundt said, adding that “we make sure that Facebook is not gathering data in an amount that might hinder competitors.”
In its statement, Facebook said that the company complied with and supported the E.U. data protection law. It also said that the antitrust agency was overstepping its jurisdiction and wading into issues that should be regulated by Europe’s data protection agencies.
The decision “underestimates the fierce competition we face in Germany, misinterprets our compliance with G.D.P.R. and undermines the mechanisms European law provides for ensuring consistent data protection standards across the E.U.,” the Facebook statement said.
The German ruling could lead to wider regulatory action against Facebook. Giovanni Buttarelli, the European data protection supervisor who oversees an independent European Union authority that advises on privacy-related laws and policies, said that data protection regulators from across Europe planned to discuss the case over the next few weeks.
His office, he said, has “consistently supported competition authorities taking action to combat abuse of dominance in a market by means of exploitation of consumers. We are therefore encouraged by this decision.”
Amie Tsang and Adam Satariano contributed reporting.