The German authorities have made it clear: Sharing user data between apps is going to be treated a lot like sex in the future. It’s a big no-no unless there is explicit and voluntary consent — especially if one party is a lot bigger than the other.
The German antitrust authorities, the Bundeskartellamt, has ruled that Facebook must get voluntary consent from people before collecting their data while using secondary Facebook services such as WhatsApp and Instagram and third-party websites. If this explicit user consent is not given, Facebook will have to substantially restrict its collection and combining of data between its various services.
The interesting wrinkle is what happens when users don’t give their approval. Andreas Mundt, President of the Bundeskartellamt stated it as a two-punch blow: “If users do not consent, Facebook may not exclude them from its services and must refrain from collecting and merging data from different sources.”
It’s a question of dominance
Both sides – the Bundeskartellamt and Facebook – are talking a lot more about market dominance than data privacy. “The extent to which Facebook collects, merges and uses data in user accounts constitutes an abuse of a dominant position,” explained the Bundeskartellamt in a blog post. The responding Facebook blog emphasizes that popularity is not dominance – and that they believe the Bundeskartellamt isn’t even the right agency to be chasing them. “The GDPR specifically empowers data protection regulators – not competition authorities – to determine whether companies are living up to their responsibilities,” said the Facebook blog. Their position is that there are lots of social media alternatives out there and that using information across services simply helps Facebook to provide them better. Consent for combining data from various sources was not mentioned in the Facebook post.
Into the uncertainty we go
Both sides are digging in and Facebook has said it will appeal the ruling within the next month. This ruling comes at an uncertain time for the technology giants. Facebook has already announced its plans to merge the Messenger, WhatsApp and Instagram messaging apps. Google has just been hit with fine in France for GDPR violations. In addition, it’s not clear if or when the United States will come up with a unified data privacy law.
No automatic default solution will be accepted
It’s time for explicit, voluntary consent
It only takes a little extrapolation to see the likely future — at least in Europe. When it comes to the collection and exchange of personally identifiable information between apps, it’s time for a mandatory ‘opt in’ from the user.