Germany’s antitrust agency today issued a ruling that seeks to limit what Facebook Inc. can do with user data from its services and the broader web.

The order follows a lengthy investigation that the agency, known as the Bundeskartellamt, launched in March 2016. At issue is Facebook’s practice of merging the data it collects about users across different services into a unified profile. That includes the activity records consumers generate on Facebook as well as the company’s two other major online properties, Instagram and WhatsApp.

The Bundeskartellamt’s ruling prohibits the social networking giant from combining records across the three services without first obtaining user consent. The order also applies to the data Facebook gathers through the millions of outside websites that use its social integrations.

Facebook can track users’ activity on other parts of the web through “Like” buttons below articles, comments linked to a user’s social account and other embedded content connected to its platform. Another source of data for the company is an ad tracking technology called Pixel. It’s a code snippet that companies can embed in their websites to capture notable events, such as if a user orders a product after following a Facebook advertisement.

“In [the] future, Facebook will no longer be allowed to force its users to agree to the practically unrestricted collection and assigning of non-Facebook data to their Facebook user accounts,” Bundeskartellamt President Andreas Mundt said in today’s ruling. “The previous practice of combining all data in a Facebook user account, practically without any restriction, will now be subject to the voluntary consent given by the users.”

The ruling could not only limit the value the company extracts from its own users’ information but also restrict its ability to track people without a Facebook account, who currently have no way of consenting to data collection.

Facebook’s tracing of nonusers has already come under fire in other parts of the European Union. Last year, a Belgian court ruled the practice to be illegal. The company was earlier slapped with a $112 million fine for “misleading” regulators about its ability to match WhatsApp profile data to Facebook accounts.

The social networking giant has a month to appeal the Bundeskartellamt’s ruling. If it fails to secure a favorable decision, Facebook will have four months to submit proposals for how to achieve compliance with the new data use requirements.

The company said in a statement that it plans to exercise its option of appealing the order. Facebook’s argument is that it faces strong enough competition in Germany that it doesn’t qualify as a dominant company, which it claims makes the scrutiny unwarranted.  

 “Bundeskartellamt underestimates the fierce competition we face in Germany, misinterprets our compliance with GDPR and undermines the mechanisms European law provides for ensuring consistent data protection standards across the EU,” Facebook wrote. 

Photo: Unsplash