Facebook has been ordered to curb its data collection practices in Germany after a landmark ruling on Thursday that the world’s largest social network abused its market dominance to gather information about users without their consent.

Germany, where privacy concerns run deep, is in the forefront of a global backlash against Facebook, fueled by last year’s Cambridge Analytica scandal in which tens of millions of Facebook profiles were harvested without their users’ consent.

The country’s antitrust watchdog objected in particular to how Facebook pools data on people from third-party apps - including its own WhatsApp and Instagram - and its online tracking of people who aren’t even members through Facebook ‘like’ or ‘share’ buttons.

“In future, Facebook will no longer be allowed to force its users to agree to the practically unrestricted collection and assigning of non-Facebook data to their Facebook accounts,” Federal Cartel Office chief Andreas Mundt said.

Facebook said it would appeal the decision, the culmination of a three-year probe, saying the regulator underestimated the competition it faced, and undermined Europe-wide privacy rules that took effect last year.

“We disagree with their conclusions and intend to appeal so that people in Germany continue to benefit fully from all our services,” Facebook said in a blog post.

In its order, the cartel office said Facebook would only be allowed to assign data from WhatsApp or Instagram to its main Facebook app accounts if users consented voluntarily. Collecting data from third-party websites and assigning it to Facebook would similarly require consent.

If consent is withheld, Facebook would have to substantially restrict its collection and combining of data. It should develop proposals to do this within 12 months, subject to the outcome of appeal proceedings at the Duesseldorf Higher Regional Court that should be filed within a month.

If Facebook fails to comply, the cartel office said it could impose fines of up to 10 percent of the company’s annual global revenues, which grew by 37 percent to $55.8 billion last year.

Antitrust lawyer Thomas Vinje, a partner at Clifford Chance in Brussels, said the Cartel Office ruling had potentially far-reaching implications.

“This is a landmark decision,” he told Reuters. “It’s limited to Germany but strikes me as exportable and might have a significant impact on Facebook’s business model.”

Vinje said it would be tough for Facebook to persuade the court that the Cartel Office’s definition of the market for social media, and its dominance, were misguided. This is a battle that many firms have fought in court and lost, he added.

IMPLICATIONS

German Justice Minister Katarina Barley welcomed the ruling. “Users are often unaware of this flow of data and cannot prevent it if they want to use the services,” she told Reuters. “We need to be rigorous in tackling the abuse of power that comes with data.”

The German antitrust regulator’s powers were expanded in 2017 to include consumer protection in public-interest cases where it could argue that a company - such as Facebook - had so little competition that consumers lack any effective choice.

Facebook has an estimated 23 million daily active users in Germany, giving it a market share of 95 percent, according to the Cartel Office which considers Google+ - a rival social network that is being closed down – to be its only competitor.

Facebook said the cartel office failed to recognize the extent of competition it faced from Google’s YouTube or Twitter for users’ attention, and also said the regulator was encroaching into areas that should be handled by data protection watchdogs.

Facebook is considering appealing on the data protection issues to the European Court of Justice, but here the Cartel Office may also have the upper hand, said Vinje, the lawyer.

"It seems to me that the Federal Cartel Office is informed by data protections, but not dependent on them, and that it has based its decision squarely on competition law,” he said.

The European Commission said: “We are closely following the work of the Bundeskartellamt both in the framework of the European Competition Network and through direct contacts.”

“The European legislator has made sure that there is now a regulation in place that addresses this type of conduct, namely the General Data Protection Regulation (GDPR),” it added.

As part of complying with the GDPR, Facebook said it had rebuilt the information its provides people about their privacy and the controls they have over their information, and improved the privacy ‘choices’ that they are offered. It would also soon launch a ‘clear history’ feature, it said.

Mundt also expressed concern over reports that Facebook, which counts 2.7 billion users worldwide, plans to merge the infrastructure of its Messenger, WhatsApp and Instagram services.

“If I understand things correctly, this move would intensify the pooling of data,” said Mundt. “It’s not very hard to conclude that, putting it carefully, this could be relevant in antitrust terms. We would have to look at this very closely.”

Facebook has said that discussions on such a move are at a very early stage.