Germany’s national competition regulator has ordered Facebook to stop combining user data from different sources without voluntary consent. The order applies to data collected by Facebook-owned platforms like WhatsApp and Instagram, but also third-party sources that Facebook uses to flesh out its advertising profiles, including those of non-users.

The Bundeskartellamt, or Federal Cartel Office (FCO), has given Facebook one month to appeal the landmark decision, which comes after a three-year investigation. If the appeal fails, the tech company will have to ensure these data sources are not combined without consent within the next four months. Although the ruling only applies within Germany, the decision could influence regulators in other countries.

In a blog post, Facebook claims that such data privacy controls do not fall under the remit of the FCO, which enforces German antitrust and competition laws. But the FCO says Facebook’s control of multiple social networks combined with its high market share is “indicative of a monopolization process” and means intervention is needed.

German regulators say users are essentially forced into Facebook’s ‘comprehensive’ data collection

“As a dominant company Facebook is subject to special obligations under competition law,“ said FCO president Andreas Mundt in a press statement. “In the operation of its business model the company must take into account that Facebook users practically cannot switch to other social networks [...] The only choice the user has is either to accept the comprehensive combination of data or to refrain from using the social network. In such a difficult situation the user’s choice cannot be referred to as voluntary consent.”

Facebook’s collection of user data outside its own sites is an often overlooked aspect of its business model, and one that the company itself doesn’t like to draw attention to.

When Facebook CEO Mark Zuckerberg testified before Congress last year, he claimed that Facebook users are always able to see the data collected about them and delete it when they like. Critics pointed out that this statement obscured practices like the creation of “shadow profiles” — user profiles of individuals who don’t have a Facebook account.

Using tools like “Like” button and Facebook Pixel, which are embedded on third-party sites and feed data back through Facebook’s services, the company can track users’ activity around the web, expanding its knowledge of individuals’ likes and preferences far beyond the information they might volunteer on the social network. When combined with information from WhatsApp and Instagram, the result is extensive and detailed tracking.

Regulators within Europe have already expressed concern about this combinatorial approach to user tracking. In 2017, the EU fined Facebook $122 million for submitting “misleading information” about plans for its WhatsApp acquisition. At the time of the acquisition in 2014, the company told regulators it would be unable to link the profiles of WhatsApp and Facebook users. Then, in 2016, it did exactly that.

Despite such regulatory action, Facebook is ramping up efforts to tie users from its different platforms closer together. Last month, it said was planning to rebuild the infrastructure of Facebook Messenger, Instagram, and WhatsApp so that all three services run on a single unified platform.