Preliminary assessment in Facebook proceeding: Facebook's collection and use of data from third-party sources is abusive

The Bundeskartellamt has informed the company Facebook in writing of its preliminary legal assessment in the abuse of dominance proceeding which the authority is conducting against Facebook. Based on the current stage of the proceedings, the authority assumes that Facebook is dominant on the German market for social networks. The authority holds the view that Facebook is abusing this dominant position by making the use of its social network conditional on its being allowed to limitlessly amass every kind of data generated by using third-party websites and merge it with the user's Facebook account. These third-party sites include firstly services owned by Facebook such as WhatsApp or Instagram, and secondly websites and apps of other operators with embedded Facebook APIs.

Andreas Mundt, President of the Bundeskartellamt: "We are mostly concerned about the collection of data outside Facebook's social network and the merging of this data into a user's Facebook account. Via APIs, data are transmitted to Facebook and are collected and processed by Facebook even when a Facebook user visits other websites. This even happens when, for example, a user does not press a "like button” but has called up a site into which such a button is embedded. Users are unaware of this. And from the current state of affairs we are not convinced that users have given their effective consent to Facebook's data tracking and the merging of data into their Facebook account. The extent and form of data collection violate mandatory European data protection principles."

According to the authority's preliminary assessment, when operating this business model Facebook, as a dominant company, must consider that its users cannot switch to other social networks. Participation in Facebook's network is conditional on registration and unrestricted approval of its terms of service. Users are given the choice of either accepting the "whole package" or doing without the service.

A private use of the network is dependent, among other things, on the fact that Facebook can unrestrictedly collect every kind of user data from third sources, attribute it to the user's Facebook account and use it for numerous data processing activities.

According to the Bundeskartellamt's preliminary assessment, Facebook's terms of service are at least in this aspect inappropriate and violate data protection provisions to the disadvantage of its users. In view of the company's dominant position, it can also not be assumed that users effectively consent to this form of data collection and processing.

In this proceeding the Bundeskartellamt focuses on the collection and use of user data from third party sources. The proceeding does not concern the collection and use of data on the Facebook network itself. The Bundeskartellamt leaves explicitly open whether this also constitutes a violation of data protection provisions and the abuse of a dominant position.

Users cannot expect data which is generated when they use services other than Facebook to be added to their Facebook account to this extent. Data are already transmitted from websites and apps to Facebook when a user calls them up or installs them, provided they have an embedded API. There are millions of such APIs embedded in German websites and apps. In the authority's assessment, consumers must be given more control over these processes and Facebook needs to provide them with suitable options to effectively limit this collection of data.

The Bundeskartellamt is closely cooperating with data protection authorities as regards the data protection aspects of the case.

Andreas Mundt: "Data protection, consumer protection and the protection of competition interlink where data, as in Facebook's case, are a crucial factor for the economic dominance of a company. On the one hand the social network offers a free service, on the other it offers attractive advertising space, which is so valuable because Facebook has huge amounts of personalised data at its disposal. In these entrepreneurial activities Facebook has to comply with rules and laws. Competition law prohibits a company from abusing its market power."

With the preliminary assessment notice, the Bundeskartellamt offers the company a chance to comment on the allegations and provide justification for its conduct or offer possible solutions.

The proceeding against Facebook is an administrative proceeding. Possible outcomes are the termination of the case, the offer of commitments by the company or a prohibition by the competition authority. A final decision on the matter is not expected before early summer 2018.

We have compiled further information on the Facebook proceeding in a background paper which can be downloaded from the Bundeskartellamt's website.