Meta may only combine personal data from Facebook, Instagram and Co. with user's consent

A legal dispute that had been running for years has ended. Meta has promised the Federal Cartel Office that it will rectify current issues and promised to comply with stricter rules for combining data. In 2019, the Federal Cartel Office prohibited Facebook (now Meta) from combining users’ personal data from various sources such as Facebook, WhatsApp, and Instagram. Meta initially objected to the ruling. The Federation of German Consumer Organisations (Verbraucherzentrale Bundesverband e.V. – vzbv) was formally involved in the legal proceedings between the German Federal Cartel Office and Meta.

Jutta Gurkmann, Director of Consumer Policy at vzbv, says:

“Facebook, Instagram, and WhatsApp are platforms used by millions of people, and these platforms are all under the control of Meta. Meta is not permitted to simply combine user data from its various services without consent and to monetise it for advertising purposes. Consumers themselves must be able to decide how their data is used. The successful end of the Federal Cartel Office proceedings thus also marks a success for consumer protection. Companies such as Meta must not be allowed to exploit their market power to collect unlimited amounts of data. Such practices come at a cost to users. This is why vzbv has been actively involved in the proceedings of the competition watchdog from the start. vzbv will also keep an eye on how the company now implements the promised improvements.”

Background

Via a prohibition order in spring 2019, the Federal Cartel Office essentially prohibited Meta (then still Facebook) from making the use of social network Facebook contractually independent on the fact that it collects for its purposes all kinds of user data from third party sources (such as WhatsApp, Instagram, social plugins, business analysis tools) and can connect these to already existing data. Facebook did not want to obtain extra consent from consumers for this. The authorities entered new territory with this legal approach. A hearing proceeding of almost three years followed.

Meta appealed against the ruling at the Düsseldorf Higher Regional Court (OLG Düsseldorf). The OLG presented various competence and GDPR interpretation questions to the CJEU for a preliminary ruling. The CJEU responded to these with its judgement on 4 July 2023. Accordingly, antitrust authorities in the Member States may intervene if companies abuse their market dominance. Should this involve data protection violations, the antitrust authorities must, however, consult with the responsible data protection authority in order to guarantee a uniform application. In the case of Meta this is the Irish Data Protection Commissioner (DPC). For the processing of consumer data, the CJEU confirmed a very strict, consumer-friendly interpretation of the European data protection law that significantly deviates from Meta’s current practices.

With its ruling of 23 June 2020, the German Federal Court of Justice (BGH) denied Meta’s request to order the suspensive effect of its appeal. The authority could have enforced the order immediately at that stage. Following negotiations, Meta has now promised to improve users’ options regarding the linking and use of their data.

Since 2019, vzbv has initiated several own actions for injunction against Facebook and other parts of the Meta corporation and has also often been successful in court. Vzbv participated in the proceedings of the Federal Cartel Office as an official intervening party and has stood up for consumers with its own applications and statements.

In addition to competition and data protection law, there are now more regulations for curbing gatekeepers such as Meta in the Digital Markets Act (DMA).

Further information

• “Facebook proceeding concluded” (Press release from the Federal Cartel Office)