Court rules Facebook's privacy settings breached German data laws

Facebook maintains changes have been made ahead of GDPR

Facebook dislike Germany

A German court has ruled that Facebook's privacy settings and use of personal data violated consumer laws as it failed to obtain adequate consent when the information was collected.

The court decided in favour of a German consumer rights group following its legal challenge against the US social media giant, finding that Facebook collects data on its users, and signs them up to services, without giving enough information for them to give meaningful consent.

Advertisement - Article continues below

The ruling was made on 16 January, however, the Federation of German Consumer Organisations (Vzbv) only publicised its victory this week.

"Facebook hides default settings that are not privacy friendly in its privacy centre and does not provide sufficient information about it when users register," saidHeiko Duenkel, legal officer at Vzbv. "This does not meet the requirement for informed consent."

Vzbv also highlighted that Facebook's smartphone app contained a number of pre-ticked boxes that authorised a location service showing where users are when they are chatting with other people. This meant that every Facebook profile was "quickly and easily findable".

The Berlin court ruled that five data privacy issues around consent were ineffective and violated Germany's Federal Data Protection Act, which states that providers should give "clear and understandable information about the nature, extent, and purpose of the use of the data".

Advertisement - Article continues below

An additional eight issues related to Facebook's Terms of Use were also deemed ineffective, including pre-approved consent statements that allowed a Facebook name and profile image to be used for "commercial, sponsored or related content", as well as being shared with the US.

Advertisement - Article continues below

Facebook's now revised policy of "authentic names", which in the past had obligated users to provide only their real name and data on the service, was also deemed to have been in violation of data protection laws.

However, Vzbv plans to appeal the decision as the court reject the group's claim that a number of Facebook's settings, which are the default for all users, deliberately misled its customers in describing the service as "free", as Vzbv maintains users are effectively forced to pay using their information.

Facebook said it also plans to appeal the decision, although it maintained that given the case dated by as far as 2015, many of its claims had been revised since, particularly in response to the impending rule changes under GDPR.

"Our products and policies have changed a lot since this case was brought, and further changes to our terms and data policy are anticipated later this year in light of upcoming changes to the law," said a Facebook spokesperson, speaking to the BBC.

Advertisement - Article continues below

GDPR will require all companies, both within the EU and those dealing with EU citizens, to be clear and explicit in their data collection policies, meaning that pre-ticked or woolly consent boxes will no longer be adequate for obtaining permission to use someone's information.

The EU has become increasingly bullish over the past few years towards the activities of social media companies operating within its borders. Facebook's data sharing deal with WhatsApp came under fire from German regulators in late 2016 after "serious concerns" were raised about the ease at which numbers and customer details were shared between the two companies.

Germany's Federal Cartel Office also revealed last month it was investigating Facebook's mass data collection, with the possibility of banning the company from harvesting and processing third-party data entirely pending its findings.

Featured Resources

The case for a marketing content hub

Transform your digital marketing to deliver customer expectations

Download now

Fast, flexible and compliant e-signatures for global businesses

Be at the forefront of digital transformation with electronic signatures

Download now

Why CEOS should care about the move to SAP S/4HANA

And how they can accelerate business value

Download now

IT faces new security challenges in the wake of COVID-19

Beat the crisis by learning how to secure your network

Download now


General Data Protection Regulation (GDPR)

ICO to relax GDPR enforcement during coronavirus economic downturn

16 Apr 2020

The NHS teams up with Apple and Google on coronavirus tracking app

14 Apr 2020
data protection

Health sites are 'unlawfully' sharing medical data with Facebook and Google

7 Apr 2020
data protection

Supreme Court rules Morrisons was not liable for 2014 data breach

1 Apr 2020

Most Popular

Network & Internet

Intel releases Wi-Fi and Bluetooth driver updates for Windows 10

26 May 2020
Server & storage

Dell EMC PowerEdge R7525 review: An EPYC core density to make Intel weep

26 May 2020
Microsoft Windows

Microsoft's latest Windows 10 update is causing yet more issues

26 May 2020