Meta Must Obtain Clear Consent for Data Collection, EU Court Asserts

Cartel Office Allowed to Review Data Protection Compliance

The Federal Cartel Office in Germany is now permitted to review compliance with data protection regulations. This decision by the European Court of Justice (ECJ) validates the authority's prohibition on the Meta Corporation (formerly Facebook) collecting user data without explicit consent.

According to the ECJ ruling, the data collection practices of the Meta Corporation cannot continue as they have been. The court has expressed doubt that all the information gathered by Meta is essential for the network's operation.

Data Collection Beyond Facebook and Co.

The court particularly takes issue with the collection of information that reveals a person's political opinions, religious affiliation, or sexual orientation. Additionally, the judges criticize the fact that these details are collected when individuals visit websites outside of Facebook, Instagram, and WhatsApp. Any interaction with pages connected to Facebook, such as through a "Like" button, is recorded by the corporation.

The ECJ has now determined that accessing a webpage does not automatically imply consent for the whole world to know about it. Under the General Data Protection Regulation (GDPR), much depends on the permissions granted by the user. Sensitive data may only be collected if the user has granted explicit approval.

According to the ruling, Meta may only access websites outside of Facebook and its affiliated platforms if users have given clear prior consent. This means that the utilization of the network must not be contingent on checking specific boxes. If necessary, Meta must prove that users genuinely had a choice in the matter.

A Triumph for the Federal Cartel Office

The ECJ ruling represents a significant success for the German Federal Cartel Office. In 2019, the authority clashed with Facebook and prohibited the company from collecting data without truly voluntary user consent. The background to this action was Facebook's dominant position in the social network market.

Facebook brought the case to court, primarily objecting to the fact that it was not a data protection authority but rather the competition authority that imposed the restrictions.

Bundeskartellamt Empowered to Intervene in Abuse Cases

As announced by the EU's highest judges, not only data protection authorities but also the Federal Cartel Office are responsible for monitoring data collection practices. The latter has the authority to intervene when it comes to identifying abusive conduct in a dominant market position. Collaboration with data protection authorities is to be expected.

Dispute Returns to German Courts

Following this decisive stance by the European judges, the dispute now returns to German courts. They must adhere to the guidelines set in Luxembourg. Consequently, the Meta Corporation will likely have to reconfirm with all its customers on Facebook, Instagram, and WhatsApp whether they consent to data collection. Users must have the freedom to choose and the ability to decline.