- The German regulator uses competition law to limit how a large platform combines its users’ data.
- Facebook may keep collecting data, but linking it to each account will require voluntary consent.
- Companies using social media pixels and tools on their websites should review how they obtain consent.
On 7 February 2019, Germany’s Federal Cartel Office (Bundeskartellamt) announced its decision to impose far-reaching restrictions on the processing of users’ data on Facebook. The platform may continue to collect data in services such as WhatsApp or Instagram, but it may only assign it to Facebook accounts if the user gives voluntary consent.
The measure also reaches data collected on third-party websites and apps through the company’s business tools. According to the authority, the terms of use that allowed that collection are justified neither under data protection principles nor under competition law standards. Facebook has twelve months to stop applying the practice objected to.
Competition and data protection
What stands out about the decision is the route chosen. The authority is not penalising a breach of the data protection regulation but an abuse of a dominant position: it considers that Facebook dominates the German market for social networks and uses that position to impose terms that users cannot refuse if they want to keep using the service.
It is a new reading, which treats personal data as an asset of market power. It is not a final ruling, as it can be appealed to the courts, and its course will depend on what the judges say. But the message to large platforms is clear: how they ask for consent and what they combine data for matters to competition regulators too.
What it means for companies
The decision does not affect only Facebook. Many companies add social buttons, tracking pixels or platform analytics tools to their websites, which send visitors’ data to third parties. The authority recalls that these tools already require consent for the data to be collected, and a website that installs them without asking may have a compliance problem.
In Spain, the rules on cookies and tracking tools are in the Information Society Services Act, which requires informing users and obtaining their consent except for strictly necessary cookies, and is complemented by the European data protection regulation. The framework therefore already binds; what changes is the attention of regulators.
What to review
A reasonable check starts by taking inventory of which third-party tools are installed on the company’s website and apps, what data they send and whether the cookie notice captures consent that is prior, informed and can be withdrawn. Tools are often installed for marketing and nobody in the company knows exactly what they collect.
It is also wise to review contracts with advertising platforms and who is responsible for what in each processing activity. The point is not to stop using these tools but to use them on a clear legal basis. A data protection adviser can help document this in a way that is proportionate to the size of the business. In parallel, the company should keep a record of the technology providers that receive data from its customers and visitors, with their purpose and legal basis, because that is the information first requested when a user or an authority makes an enquiry. Small companies can rely on consent management tools that already include the necessary texts and records, provided they are properly configured and checked periodically, because a default setting does not always match what the company actually does.
Customer data is an asset, and using it without a clear basis ends up being a risk.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
