Germany orders Facebook to stop combining data from WhatsApp, Instagram, and third-party sites with data in a user's main Facebook account without their consent
Germany's competition authority has told Facebook it can only continue gathering so much data about users from beyond its app and website if it gets individuals' consent.
Context & Ripple Effects
This ruling closes a loop Germany's antitrust watchdog opened back when it hit Facebook with an investigation over its user terms in 2016 (an inquiry into how its terms treated user data). That same year, German authorities separately ordered Facebook to stop collecting WhatsApp users' data and delete what it had already pulled in on roughly 35M German users (the 2016 WhatsApp data deletion order) — so the 2019 consent requirement extends a fight that predates GDPR enforcement headlines.
What changes now is scope: not just WhatsApp-to-Facebook flows but Instagram and third-party-site data too, all gated behind individual consent inside Germany. Facebook's immediate response is an appeal, meaning the operational question — whether off-Facebook data keeps flowing into ad targeting — stays contested rather than settled.
First-order effects
- Facebook must obtain explicit user consent before merging WhatsApp, Instagram, and third-party-site data into German users' main accounts, directly constraining the cross-app data pool that feeds its ad targeting in one of Europe's largest markets.
- Facebook's declared appeal keeps the current data-combination practice running while the case is litigated, so the immediate cost is legal exposure and compliance planning rather than an instant product change.
Second-order effects
- A loss on appeal would force Facebook to segment German users' profiles from its other services, degrading targeting quality there relative to competitors whose single-service models don't depend on cross-app combination — a structural disadvantage unique to its bundled architecture.
- The precedent hands other regulators a template: the 2021 follow-up shows Germany escalating to a three-month emergency ban on WhatsApp data collection, indicating the watchdog treats each new terms-of-service rollout as a fresh enforcement trigger.
Third-order effects
- If the pattern holds, competition authorities become de facto data-privacy enforcers for platforms — Germany's data protection watchdog later told the EU Parliament it had sent 50+ WhatsApp complaints to Ireland's lead regulator with none closed (friction over who actually polices Meta in the EU), pointing toward a power struggle over enforcement venue.
- Sustained national fragmentation of data rules could push Meta toward region-specific data architectures, unwinding the unified cross-service profile that made the WhatsApp and Instagram acquisitions strategically valuable.
The trend: Competition law is becoming the enforcement route of choice against cross-platform data combination, with Germany's escalating orders against Facebook serving as the template other regulators may copy.