The Bundeskartellamt has concluded its Facebook proceeding. The result of the proceeding is a bundle of measures that gives users of the social network Facebook significantly improved options regarding the combination of their data.

In February 2019 the Bundeskartellamt had prohibited Meta (formerly Facebook) from combining personal user data from different sources without user consent. Meta had appealed this decision. Over the years of legal proceedings, in which the Federal Court of Justice (2020) and the Court of Justice of the European Union (2023) confirmed the Bundeskartellamt’s position on matters of principle, Meta and the Bundeskartellamt also intensively negotiated concrete measures to implement the authority’s decision. Meta’s individual measures are now deemed to be a sufficiently effective package to allow the Bundeskartellamt to close the case. Meta has withdrawn the appeal pending before the Düsseldorf Higher Regional Court (OLG Düsseldorf) against the Bundeskartellamt’s decision. The decision is thus final.

Andreas Mundt, President of the Bundeskartellamt: “Our 2019 Facebook decision can still be considered groundbreaking today. As a result of our decision, Meta has made very significant changes to the way it handles user data. The main change is that using the Facebook service no longer requires users to consent to Meta collecting a limitless amount of data and linking such data to their user accounts, even if these data are not even generated while using Facebook. This applies to Meta services such as Instagram or third-party websites and apps. This means that users now have much greater control over how their data are combined. In addition to these very concrete improvements, the Bundeskartellamt’s decision has also led to an important landmark ruling by the Court of Justice of the European Union and has inspired legislative initiatives at both national and European level. This also means that the situation in terms of legal clarity and the instruments available to us to intervene in this area is very different today than it was five years ago.”

Before the Bundeskartellamt’s decision, the social network Facebook could only be used on condition that Facebook was allowed to also collect data about users outside the Facebook service and link such data to the relevant Facebook accounts. This included data from other services offered by the company (such as Instagram) as well as data collected in third-party apps and on third-party websites. The only choice users had was to either agree to an almost limitless amount of data being combined or not use the social network at all. The Bundeskartellamt had prohibited these terms of use and determined that data could only be combined with the user’s distinct consent, which, however, could not be made a condition for using Facebook (see press release of 7 February 2019).

Before the proceeding was concluded, there had been intensive discussions between Meta and the Bundeskartellamt, during which Meta had gradually taken or agreed to take the following measures to implement the authority’s decision:

• Introducing an Accounts Centre (see press release of 7 June 2023) to keep data collected from Meta’s different services separate: The Accounts Centre allows users to decide themselves which Meta services (e.g. Facebook and Instagram) they would like to connect and thus allow data to be shared between these services also for advertising purposes. It is still possible to use the services separately without experiencing a significant loss in quality.
• Introducing “cookie” settings that allow Facebook data to be separated from other data: Facebook’s “cookie” settings now allow users to decide whether they want to allow their Facebook data to be combined with data Meta collects from third-party websites or apps using its so-called business tools. This also applies to Instagram.
• Special exception for Facebook Login: Users who choose not to combine their Facebook data with their data collected while using other websites or apps can make an exception for Facebook Login to still be able to use this log-in option in third-party apps or on third-party websites. Previously, users had to allow Meta to combine all user data with data from third-party apps or websites if they wanted to use Facebook Login.
• Concise customer information: To help Meta’s customers quickly find the relevant settings to prevent the unwanted combination of data by Meta, users who have agreed to data being combined in the past are shown prominent notifications when accessing Facebook. These notifications contain direct links to the newly designed consent options.
• User navigation: Meta has added a prominent notice at the beginning of its data policy, informing users about their options (https://en-gb.facebook.com/privacy/policy/?entry_point=facebook_page_footer “How to manage the info that we use”). This contains a short explanation and links to the Accounts Centre and “cookie” settings.
• Limited combination of data for security purposes: Regardless of the user’s settings in Facebook or Instagram, Meta stores and combines usage data for security purposes. However, this is done only temporarily and for no longer than a standardised period of time defined in advance.

Andreas Mundt: “Altogether, these tools give users much greater control over the extent to which personal data from other Meta services and third-party apps and websites are linked to their Facebook account.”

The measures described above have already been implemented or will be implemented in the coming weeks.

The fact that the Bundeskartellamt has concluded the proceeding does not mean that all competition-law concerns have been fully eliminated. Rather, the measures taken by Meta were deemed to be a sufficiently suitable package to allow the Bundeskartellamt to discontinue its enforcement action and close the case against Meta at its discretion. This is also due to the fact that other authorities have effective and appropriate tools at their disposal to achieve further improvements for users of Meta services in the European Union, if necessary. The conclusion of the proceeding based on the package of measures described above thus does not imply any finding as to whether Meta complies with the obligations resulting from these tools. The European Commission, for example, now has the power to take action against combining data across different services of so-called gatekeepers if users have not given their valid consent; this is set out in Article 5(2) of the Digital Markets Act (DMA), which draws on the issues underlying the Bundeskartellamt’s Facebook decision. In applying the General Data Protection Regulation, data protection authorities can check the extent to which consent is in fact freely given and whether data processing, including within individual services, is excessive. Consumer protection rules could also be applied to how Meta designs its user dialogues.

Given a certain degree of similarity between the issues raised by competition law and data protection law, the Bundeskartellamt regularly exchanged views with the data protection authorities during the proceeding. In addition, the Bundeskartellamt was supported on technical issues by the Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, BSI). The Federation of German Consumer Organisations (Verbraucherzentrale Bundesverband, vzbv) was also involved in the proceeding as a third party.

Background information:

On 6 February 2019 the Bundeskartellamt issued a decision prohibiting Meta (formerly Facebook) from combining user data from different sources without the users’ consent. Meta appealed this decision to the Düsseldorf Higher Regional Court. On 26 August 2019, the court ordered the suspensive effect of the appeal at Meta’s request. On 23 June 2020 the Federal Court of Justice revoked this decision at the Bundeskartellamt’s request and denied Meta’s request to order the suspensive effect of its appeal. On 24 March 2021 the Düsseldorf Higher Regional Court referred certain questions to the Court of Justice of the European Union (CJEU) and suspended the proceeding until the CJEU’s decision. Among other things, the CJEU was supposed to clarify whether the Bundeskartellamt can also interpret GDPR provisions when weighing interests in decisions under competition law. The European Court of Justice ruled in favour of this in its decision of 4 July 2023 (case C-252/21). In view of the discussions between the parties, the proceeding before the Düsseldorf Higher Regional Court was no longer actively pursued and has now ended with Meta withdrawing its appeal.

The lawfulness of Meta’s pay-or-consent model, under which users can pay to use Facebook or Instagram without adds, is currently being debated. Several European consumer organisations have filed complaints with their national data protection authorities (see https://www.beuc.eu/press-releases/consumer-groups-launch-complaints-against-metas-massive-illegal-data-processing). The European Data Protection Board has also criticised such models in a statement of 17 April 2024 (see https://www.edpb.europa.eu/system/files/2024-04/edpb_opinion_202408_consentorpay_en.pdf). The European Commission considers Meta’s pay-or-consent model likely to fail to comply with the Digital Markets Act (DMA), which has been enforceable since 7 March 2024, and has communicated its preliminary findings to Meta on 1 July 2024 (see https://ec.europa.eu/commission/presscorner/detail/en/ip_24_3582).

The case summary is available here.