Facebook’s massively lucrative advertising model relies on tracking its one billion users---as well as the billions on WhatsApp and Instagram---across the web and smartphone apps, collecting data on which sites and apps they visit, where they shop, what they like, and combining all that information into comprehensive user profiles. Facebook has maintained that collecting all this data allows the company to serve ads that are more relevant to users’ interests. Privacy advocates have argued that the company isn’t transparent enough about what data it has and what it does with it. As a result, most people don’t understand the massive trade-off they are making with their information when they sign up for the “free” site.

On Thursday, Germany’s Federal Cartel Office, the country’s antitrust regulator, ruled that Facebook was exploiting consumers by requiring them to agree to this kind of data collection in order to have an account, and has prohibited the practice going forward.

“Facebook will no longer be allowed to force its users to agree to the practically unrestricted collection and assigning of non-Facebook data to their Facebook user accounts,” FCO president Andreas Mundt said in a statement announcing the decision.

“We disagree with their conclusions and intend to appeal so that people in Germany continue to benefit fully from all our services,” Facebook wrote in a blog post responding to the ruling. The company has one month to appeal. If it fails, Facebook would have to change how it processes data internally for German users, and could only combine the data into a single profile for a Facebook account with that user's explicit consent.

“When there is a lack of competition, users accepting terms of service are often not truly consenting. The consent is a fiction.” Lina Khan, Open Markets

“This is significant,” says Lina Khan, an antitrust expert affiliated with Columbia Law School and the think tank Open Markets. She notes that authorities haven’t done a good job of articulating why privacy is an antitrust issue. Here, the German regulator makes it clear. “The FCO’s theory is that Facebook’s dominance is what allows it to impose on users contractual terms that require them to allow Facebook to track them all over,” Khan says. “When there is a lack of competition, users accepting terms of service are often not truly consenting. The consent is a fiction.”

According to the FCO, Facebook had 32 million monthly active users in Germany at the end of last year, amounting to a market share of more than 80 percent. The regulator argues this dominance gives it jurisdiction to oversee the company’s data collection practices.

“As a dominant company Facebook is subject to special obligations under competition law. In the operation of its business model the company must take into account that Facebook users practically cannot switch to other social networks,” said Mundt. “The only choice the user has is either to accept the comprehensive combination of data or to refrain from using the social network. In such a difficult situation the user’s choice cannot be referred to as voluntary consent.”

The FCO further argues that Facebook used its vast data collection to build up its market dominance, creating a feedback loop wherein people have no choice but to use the site and allow it to track them, which makes the site even more dominant and entrenches its privacy violations.

“The Bundeskartellamt [FCO] underestimates the fierce competition we face in Germany, misinterprets our compliance with GDPR and undermines the mechanisms European law provides for ensuring consistent data protection standards across the EU,” Facebook wrote in response to the ruling. They cite Snapchat, Twitter, and YouTube as direct competitors, hoping to illustrate that there isn’t lack of competition, and therefore the FCO has no standing to apply rules based on Facebook’s dominance. “Popularity,” they write, “is not dominance.”

The FCO disagreed, explaining that Snapchat, YouTube, and Twitter serve totally different functions from Facebook, and therefore can’t be seen as viable alternatives to the service.

Antitrust regulators used to consider data and privacy outside their purview. The old philosophy held that antitrust was concerned with price, and if a product was free then consumers couldn’t be harmed, says Maurice Stucke, antitrust expert and law professor at the University of Tennessee. “What we’re seeing now is those myths are being largely discredited.”