Meta to let users refuse its cross-site tracking following German antitrust intervention

Meta has been dragged kicking and screaming into another notable privacy concession in Europe: The German Federal Cartel Office (FCO) has announced a new account center incoming which will see the tech giant provide users of its social networking services with a greater degree of choice over whether they allow it to combine data on their activity across its services or not.

It will be the first time Meta has provided such a degree of choice over its cross-site tracking and profiling of users. However it’s notable the competition authority is not entirely impressed with what Meta has cooked up — as it describes the updated accounts center as allowing Meta’s customers to make “a largely free and informed decision about whether they want to use Meta’s services separately or in combined form” (emphasis ours).

“Using the services in combined form would allow them to use additional functionalities such as crossposting, where a post is simultaneously published across several social media outlets but Meta would then use the combined data for advertising purposes,” the FCO also specifies, confirming Meta is intending to bundle its ads processing of users’ cross-platform activity with a service utility (cross-posting). So if you want to cross-post you have to agree to being profiled across its services. (Hence, presumably, the FCO’s qualification that the choice it’s offering users is not entirely free.)

This may sound like splitting hairs but it’s an important legal distinction since European Union and German data protection law demands that if you’re relying on consent to process people’s information an individual’s decision to grant consent must be informed, purpose specific (i.e. not bundled) and freely given.

We’ve reached out to the FCO with questions.

Meta is not taking this step to boost user choice over its tracking and profiling — even to this qualified degree — of its own volition; the development follows a lengthy battle with Germany’s antitrust authority over the adtech giant’s so-called ‘superprofiling’ of users which the FCO views as an “exploitative abuse” of its market power, as the dominant player in social media, and therefore as an antitrust abuse it can enforce against.

In a pioneering February 2019 order the FCO sought to do that by prohibiting Meta from combining data on users without their consent. However Meta moved to challenge the order in the German courts — which led to a stay and, more latterly, to a referral to the European Union’s top court.

The latter is slated to hand down a ruling on July 4. So Meta’s move to offer more of a choice now looks to be in anticipation of a CJEU decision that does not go its way. (An influential advisor to the court already published an opinion last year that backed competition authorities being able to factor data protection compatibility into their competition assessments so it may see the writing on the wall here.)

In a statement accompanying its announcement of the revised meta account center, the FCO’s president Andreas Mundt, described the development as “an important step” — but also warns “the process is not yet concluded”.

“In 2019 we broke new ground in the area of competition law with our Facebook decision, which is based on the general prohibition of abusive practices. We now see that it’s a rocky road to a free and informed user decision on how their data is being processed but it can be achieved,” he added.

Reached for comment, Meta emailed this statement attributed to a company spokesperson:

We continue to make it simpler and more convenient for people to communicate and access new experiences across our family of apps. As part of this, we will update our Accounts Centre to be more transparent about how our services work together and to give people more control over these experiences. We will continue to work constructively with the FCO, and appreciate its recognition of our ongoing work to improve transparency and user choice.

We understand the roll out of the new account center will begin this month — and that it will be applied globally, rather than just for users in Germany. (But make no mistake; this global privacy concession has been driven by the German authority.)

The FCO’s press release chronicles how it has worked on Meta since the 2019 decision — a process it says led to the company offering an accounts center in the first place, albeit one the authority judged to be “seriously deficient”; including on account of manipulative design choices by Meta (the FCO says the company had failed to “inform customers in a neutral way nor were all relevant pieces of information shown in a transparent and easily accessible form”).

That was followed, in February this year — after “intensive” talks — by Meta submitting a revised plan to implement the FCO decision, including what the authority couches as a “significantly modified accounts center”.

“Meta made a number of changes to the accounts center in the process, which made the overall user journey significantly more transparent and comprehensible,” it explains. “Several design elements and wordings were changed that could have nudged users to combine their accounts. The wording was also changed to specify in greater detail what is actually meant (e.g. ‘personal data’ instead of ‘information’); and finally, the process required to separate accounts was considerably simplified.”

“Although there is still potential for optimisation, it can ultimately be said that Meta’s customers can now make a largely free and informed decision when using the accounts center. They will be presented with a general choice: Either they use all services separately with all major functions or they decide to use additional functionalities across accounts, which involves sharing more personal data,” the FCO added.

While the regulator appears to have (largely) accepted this qualified choice, the design of other elements of Meta’s service remain a concern for the FCO, which also notes that it “remains to be clarified how users can be informed as correctly and neutrally as possible about the use and data processing consequences involved in Meta’s Business Tools and plugins (e.g. Facebook Login, ‘Like’ button) in a central location and how they can consent to or reject the use of their data in a simple way, and under which exceptional circumstances data processing across accounts can be legal even without the users’ consent (e.g. for security purposes)”.

“Unless the required consent has been free and informed, it has to be requested again,” it also warns in another shot across Meta’s bow.

The authority also points out that standards underpinning its 2019 Facebook decision do not necessarily represent the final word on Meta’s legal compliance around data protection issues — given a subsequent update to Germany’s digital competition law (which the FCO confirmed last year applies to Meta’s business); and given a pan-EU ex ante competition reform which targets intermediating tech giants (aka the Digital Markets Act; DMA) that’s very likely to be applied to Meta too (and which the FCO notes “may require stricter standards”).

(Notably, the DMA puts some limits on use of data for behavioral advertising — with a total ban on use of sensitive data and a ban on processing children’s data for ads that will require further privacy concessions from the company.)

In a further caveat, the FCO warns against any attempts to over-leverage its assessment that the accounts center (just about) passes muster, with the authority writing: “It should also be noted that the assessment of Meta’s accounts center cannot simply be transferred to other situations in which users make choices, because in each case the implications and the overall context of the respective user decision have to be taken into account.”

In recent months, a major privacy enforcement by European Union data protection authorities has also forced Meta to reconfigure its operations and provide regional users with the ability to request an opt-out of its behvioral advertising.