Germany has ordered Facebook to rein in its data collection

German regulators are trying to clamp down on Facebook’s data collection practices — a move that could force Facebook to make technical changes to its app in order to continue operating in the country.

The Bundeskartellamt, Germany’s Federal Cartel Office in charge of antitrust laws, restricted Facebook from “[merging] user data from various sources,” the office announced Thursday.

Essentially, it wants to block Facebook from combining user data that it collects through its other apps, like WhatsApp and Instagram, with data on Facebook. This would also restrict Facebook from collecting and combining any “data collected on third-party websites,” such as cookie data Facebook uses to target people with advertising.

If Facebook wants to merge this data — to use your web browsing history to show you a targeted ad, for example — it would need to get “voluntary consent of the user.”

Andreas Mundt, the president of the Bundeskartellamt, says that Facebook’s massive scale in Germany is what has spurred regulators to take action. The Bundeskartellamt claims that 23 million out of Germany’s 80 million citizens use Facebook every day.

“The extent to which Facebook collects data without the consent of the user, feeds it to the user account and exploits it is abusive,” the agency’s press release said.

Facebook, as you might imagine, disagrees with the regulatory penalty. The company is arguing that it is compliant with new General Data Protection Regulation rules that were implemented across Europe last May — rules that are intended to protect user privacy and add more controls over how and why internet companies collect personal information. Following those rules, Facebook argues, is a sign that it is collecting user data appropriately.

“The Bundeskartellamt has overlooked how Facebook actually processes data and the steps we take to comply with the GDPR,” Facebook wrote in a blog post Thursday.

Facebook is also arguing that the Bundeskartellamt shouldn’t be regulating the company at all — at least not for data privacy issues. The Bundeskartellamt is primarily an antitrust regulator, meaning it handles issues of business competition, not data privacy, Facebook says.

“The GDPR specifically empowers data protection regulators — not competition authorities — to determine whether companies are living up to their responsibilities,” Facebook wrote.

The ruling — which would go into effect in one year and which Facebook plans to appeal — is problematic, though not necessarily surprising.

Europe has been much tougher on data privacy than the United States, hence the GDPR requirements. Facebook also knew that something like this would happen, though maybe not necessarily in Germany. That’s why it hired former UK Deputy Prime Minister Nick Clegg to serve as its top policy and communications executive late last year. Facebook knew that European regulators were more likely than US regulators to punish the company for its data policy practices.

The concerning part, though, is that this regulation, if it is upheld, would theoretically be crippling to Facebook’s business. There’s a technical component: A lot of people sign up for Instagram with their Facebook account, for example, or see ads on Instagram because of activity from their Facebook profile. Uncoupling all of Facebook’s apps would be a technical hurdle, to say the least.

Then there’s the business part of it: Even if Facebook did silo all its user data into its respective apps, the German regulation could hurt the company’s advertising business. If Facebook was banned from collecting data from outside the social network — like the websites you visit — to help with ad targeting, that could eliminate part of its competitive advantage. That granular level of ad targeting, coupled with Facebook’s massive audience, is what makes it so dominant in the world of digital ads.

All of this seems unlikely, though. Not only does Facebook have a year, if not longer, to fight this in court, it seems possible that Facebook will simply find a better way to get “voluntary consent of the user” to use all this information. People around the world agree to Facebook’s data collection policies every day. Facebook will find a way to get people to agree in Germany, as well.

This article originally appeared on Recode.net.

Will you join us?

Our biggest supporters are our readers — and we’re so grateful to everyone who has made a contribution during our September campaign. We’re less than 1,000 contributions away from reaching our goal for the month, which in turn will allow us to say yes more often when our incredible journalists come to us with questions they want to answer and projects they want to pursue. Will you make a contribution before the month ends and support our policy coverage through 2024 and beyond?

One-Time Monthly Annual

$5/month

$10/month

$25/month

$50/month

Other

$

Yes, I'll give $5/month

Yes, I'll give $5/month

We accept credit card, Apple Pay, and Google Pay. You can also contribute via