Facebook’s massively lucrative advertising model relies on tracking its one billion users—as well as the billions on WhatsApp and Instagram—across the web and smartphone apps, collecting data on which sites and apps they visit, where they shop, what they like, and combining all that information into comprehensive user profiles. Facebook has maintained that collecting all this data allows the company to serve ads that are more relevant to users’ interests. Privacy advocates have argued that the company isn’t transparent enough about what data it has and what it does with it. As a result, most people don’t understand the massive trade-off they are making with their information when they sign up for the “free” site.
On Thursday, Germany’s Federal Cartel Office, the country’s antitrust regulator, ruled that Facebook was exploiting consumers by requiring them to agree to this kind of data collection in order to have an account, and has prohibited the practice going forward.
“Facebook will no longer be allowed to force its users to agree to the practically unrestricted collection and assigning of non-Facebook data to their Facebook user accounts,” FCO president Andreas Mundt said in a statement announcing the decision.
“We disagree with their conclusions and intend to appeal so that people in Germany continue to benefit fully from all our services,” Facebook wrote in a blog post responding to the ruling. The company has one month to appeal. If it fails, Facebook would have to change how it processes data internally for German users, and could only combine the data into a single profile for a Facebook account with that user’s explicit consent.
“When there is a lack of competition, users accepting terms of service are often not truly consenting. The consent is a fiction.”
Lina Khan, Open Markets
“This is significant,” says Lina Khan, an antitrust expert affiliated with Columbia Law School and the think tank Open Markets. She notes that authorities haven’t done a good job of articulating why privacy is an antitrust issue. Here, the German regulator makes it clear. “The FCO’s theory is that Facebook’s dominance is what allows it to impose on users contractual terms that require them to allow Facebook to track them all over,” Khan says. “When there is a lack of competition, users accepting terms of service are often not truly consenting. The consent is a fiction.”
According to the FCO, Facebook had 32 million monthly active users in Germany at the end of last year, amounting to a market share of more than 80 percent. The regulator argues this dominance gives it jurisdiction to oversee the company’s data collection practices.
“As a dominant company Facebook is subject to special obligations under competition law. In the operation of its business model the company must take into account that Facebook users practically cannot switch to other social networks,” said Mundt. “The only choice the user has is either to accept the comprehensive combination of data or to refrain from using the social network. In such a difficult situation the user’s choice cannot be referred to as voluntary consent.”
The FCO further argues that Facebook used its vast data collection to build up its market dominance, creating a feedback loop wherein people have no choice but to use the site and allow it to track them, which makes the site even more dominant and entrenches its privacy violations.
“The Bundeskartellamt [FCO] underestimates the fierce competition we face in Germany, misinterprets our compliance with GDPR and undermines the mechanisms European law provides for ensuring consistent data protection standards across the EU,” Facebook wrote in response to the ruling. They cite Snapchat, Twitter, and YouTube as direct competitors, hoping to illustrate that there isn’t lack of competition, and therefore the FCO has no standing to apply rules based on Facebook’s dominance. “Popularity,” they write, “is not dominance.”
The FCO disagreed, explaining that Snapchat, YouTube, and Twitter serve totally different functions from Facebook, and therefore can’t be seen as viable alternatives to the service.
Antitrust regulators used to consider data and privacy outside their purview. The old philosophy held that antitrust was concerned with price, and if a product was free then consumers couldn’t be harmed, says Maurice Stucke, antitrust expert and law professor at the University of Tennessee. “What we’re seeing now is those myths are being largely discredited.”
The most remarkable part of the ruling is the way it makes clear that privacy and competition are inextricably intertwined. “On the one hand there is a service provided to users free of charge. On the other hand, the attractiveness and value of the advertising spaces increase with the amount and detail of user data,” Mundt said. “It is therefore precisely in the area of data collection and data use where Facebook, as a dominant company, must comply with the rules and laws applicable in Germany and Europe.”
“This is the first instance where [regulators] are saying that because [a company has] such market power that consent is not freely given,” says Stucke.
The FCO ruling explains that the harm to users from Facebook’s data collection is not in cost but in “loss of control.” “They are no longer able to control how their personal data are used. They cannot perceive which data from which sources are combined for which purposes with data from Facebook accounts and used e.g. for creating user profiles,” the FAQ on the ruling reads. That combining of data gives it a “significance the user cannot foresee.”
That fact is underscored by people’s ignorance of Facebook data practices. Roughly 74 percent of American Facebook users surveyed recently by the Pew Charitable Trusts did not know that Facebook maintained profiles about their interests. Fifty-one percent of those surveyed said they weren’t comfortable with the practice.
But Facebook says that tracking people makes the services safer and better, and that the FCO misses how much the company has done in order to comply with the General Data Protection regulation passed by the European Union in 2018.
The FCO’s ruling, however, directly addresses the GDPR, writing that under its principles Facebook has “no effective justification for collecting data from other company-owned services and Facebook Business Tools or for assigning these data to the Facebook user accounts.” (Facebook Business Tools are the Like and Share buttons that appear all over the internet, and which allow Facebook to track you on sites they don’t own.) In other words, in addition to being anticompetitive in its view, the FCO believes Facebook hasn’t proven that data collection and bundling is in the best interest of every consumer and that its sites couldn’t function without it.
If Facebook loses the appeal, then Germany will become a grand experiment in whether the surveillance economy is actually essential to the operation of social media. Other Europeans and Americans may demand they are given the same option. “This ruling is really an icebreaker. Icebreakers break through the ice in order to lead the path for other vessels to follow,” says Stucke.
More Great WIRED Stories