BONN, Germany (Reuters) – Germany’s antitrust watchdog ordered a crackdown on Facebook’s data collection practices after ruling the world’s largest social network abused its market dominance to gather information about users without their knowledge or consent.

Facebook said it would appeal the landmark ruling on Thursday by the Federal Cartel Office, the culmination of a three-year probe, saying the watchdog underestimated the competition it faced and undermined Europe-wide privacy rules that took effect last year.

“In future, Facebook will no longer be allowed to force its users to agree to the practically unrestricted collection and assigning of non-Facebook data to their Facebook accounts,” Cartel Office Chief Andreas Mundt said.

The findings follow fierce scrutiny of Facebook over a series of privacy lapses, including the leak of data on tens of millions of Facebook users, as well as the extensive use of targeted ads by foreign powers seeking to influence elections in the United States.

The cartel office objected in particular to how Facebook acquires data on people from third-party apps – including its own WhatsApp and Instagram services – and its online tracking of people who aren’t even members.

That includes tracking visitors to websites with an embedded Facebook ‘like’ or share button – and pages where it observes people even though there is no obvious sign the social network is present.

The ruling does not yet have legal force and Facebook has a month to appeal, which the social network said it would do.

“We disagree with their conclusions and intend to appeal so that people in Germany continue to benefit fully from all our services,” Facebook said in a blog post.

“The Bundeskartellamt underestimates the fierce competition we face in Germany, misinterprets our compliance with the GDPR, and threatens the mechanism European law provides for ensuring consistent data protection standards across the EU.”

VOLUNTARY CONSENT

In its order, the Cartel Office said it would only be possible to assign data from WhatsApp or Instagram to Facebook subject to the voluntary consent of users.

Collecting data from third-party websites and assigning them to Facebook would only be allowed if users give their voluntary consent.

If consent is withheld, Facebook would have to substantially restrict its collection and combining of data, and should develop proposals for solutions to do this within 12 months, Mundt said.

Facebook, responding, said the Cartel Office failed to recognise that it competes with other online services, such as video app YouTube or Twitter, the short-messaging service, for people’s attention.

It also faults the antitrust body for encroaching in areas properly dealt with by data protection regulators under the European Union’s General Data Protection Regulation (GDPR), a broad privacy regime that entered force last May.

“We support the GDPR and take our obligations seriously. Yet the Bundeskartellamt’s decision misapplies German competition law to set different rules that apply to only one company,” Facebook said in its blog.

As part of complying with the GDPR, Facebook said it had rebuilt the information its provides people about their privacy and the controls they have over their information, and improved the privacy ‘choices’ that they are offered. It would also soon launch a ‘clear history’ feature.

“The (Cartel Office) has overlooked how Facebook actually processes data and the steps we take to comply with the GDPR,” Facebook said.