Germany's Federal Cartel Office (Bundeskartellamt, the country's antitrust regulator) has ruled that Facebook can't combine user data aggregated from different sources (Facebook usage data, data from pages with Facebook Like buttons, data purchased from third parties, etc), because users can't reasonably anticipate the way these different datastreams might be combined, nor the kinds of inferences that could be gleaned thereby.
Facebook's practice of using clickthrough agreements to perform a kind of parody of consent was ruled invalid by the FCO, which pointed to Facebook's market dominance as the basis for subjecting it to stricter scrutiny and controls.
Facebook has said it will appeal.
The FCO singled out the lack of competitiveness in Facebook's market as the factor that swayed its judgment, arguing that Facebook has inserted itself into the social lives of Germans in such a way that failing to use it amounts to opting out of large slices of civic life, and thus the take-it-or-leave-it privacy waiver Facebook imposes on its users can't be characterized as an "agreement" of any kind — rather, it is a form of coerced consent, which is to say, not consent at all.
The regulator invoked the GDPR, stating that Facebook had no credible purpose for blending data from multiple sources: users don't benefit from this mixing, and Facebook could operate just as well (if not as profitably) without this mixing.
The FCO ruling explains that the harm to users from Facebook’s data collection is not in cost but in “loss of control.” “They are no longer able to control how their personal data are used. They cannot perceive which data from which sources are combined for which purposes with data from Facebook accounts and used e.g. for creating user profiles,” the FAQ on the ruling reads. That combining of data gives it a “significance the user cannot foresee.”
German Regulators Just Outlawed Facebook's Whole Ad Business [Emily Dreyfuss/Wired]
