The German competition authority, called the Bundeskartellamt, said it was imposing far-reaching restrictions on how Facebook processes user data and gathers consent. Specifically, it said Facebook could no longer combine users' data from separate apps like WhatsApp and Instagram without voluntary user consent. The decision is the culmination of a three-year investigation into the social media company by the German watchdog.
"In future, Facebook will no longer be allowed to force its users to agree to the practically unrestricted collection and assigning of non-Facebook data to their Facebook user accounts," Andreas Mundt, president of the Bundeskartellamt, said in a press release Thursday.
"The Bundeskartellamt underestimates the fierce competition we face in Germany, misinterprets our compliance with GDPR and undermines the mechanisms European law provides for ensuring consistent data protection standards across the EU," Facebook said.
GDPR, short for the General Data Protection Regulation, is a sweeping set of data privacy rules that went into effect across the EU last May. Companies that don't meet GDPR's requirements face strict fines of up to 4 percent of global annual revenues.
Germany's competition authority said Facebook's terms of service, and the manner in which it collects and uses data, are in violation of Europe's data protection rules. The watchdog said many users are unaware that Facebook collects an "almost unlimited" amount of data from third-party sources, including Facebook-owned Instagram and WhatsApp, that the company then links to a user's Facebook account.
In its blog post, Facebook hit back at the German watchdog, saying it is up to data protection authorities, not competition regulators, to determine GDPR compliance.