Decision on Facebook
Total Page:16
File Type:pdf, Size:1020Kb
6th Decision Division B6-22/16 ADMINISTRATIVE PROCEEDINGS Decision under Section 32(1) German Competition Act (GWB) - Public version - Decision In the administrative proceedings 1. Facebook Inc., […], Menlo Park, […], U.S.A. - Party under 1. - 2. Facebook Ireland Ltd., […], Dublin, Ireland, - Party under 2. - 3. Facebook Deutschland GmbH, […], Hamburg - Party under 3. - Authorised representatives of 1. -3.: […] 4. Verbraucherzentrale Bundesverband e.V., […] Berlin - Third parties admitted to the proceedings - the 6th Decision Division of the Bundeskartellamt has decided on 6 February 2019: 2 1. The parties 1-3, including any associated companies pursuant to Section 36(2) GWB, are prohibited from using terms of service including specific provisions of data and cookie policies and similar contractual terms which stipulate that the private use by users1 residing in Germany of the service available under the web addresses facebook.com and facebook.de and via the mobile “Facebook” app (both offers hereinafter referred to as Facebook.com) is conditional on the following: a. Facebook.com’s operating company can collect user and device-related data collected and saved from private users residing in Germany when using WhatsApp, Oculus and Masquerade and – without the user’s consent - combine these data with their data collected and saved while using Facebook.com and use the data; b. Facebook.com’s operating company can – without the user’s consent - combine user and device-related data collected from private users residing in Germany when using Instagram with their data collected and saved while using Facebook.com and use the combined data; c. Facebook.com’s operating company or a corporate provider of the programming interfaces (Facebook Business Tools) can – without the user’s consent - collect any user or device-related data from users residing in Germany via programming interfaces that are integrated into websites or apps to create social plugins, Facebook Login and Account Kit, as well as measurement and analysis services based on Facebook Pixel and Facebook SDK, when users use websites or mobile apps by third-party providers, combine the data with data collected in the context of the use of Facebook.com and use the data ; where, in particular, the first paragraph of section 2 of the current terms of service (“Our Data Policy and Your Privacy Choices”), which contains provisions stating that personal data is collected and used to provide the services and that the user can refer to the data policy to learn how his data is collected and used, is specified by the following guidelines: - the provision which is currently section I of the printable version of the Facebook Data Policy (“What kinds of information do we collect?”) explains that the collection of information provided by the user, device-related information and information provided by partners applies to all so-called “Facebook Products”, which include, according to the given definition, all products of the Facebook […] 3 group including corporate services and Facebook Business Tools, which are used by so-called “Facebook Partners” to send information; - the provision currently contained in section II of the printable version of Facebook’s Data Policy under the headline “How do we use this information? - Provide, personalize and improve our Products”, bullet point “Information across Facebook Products and devices”, explains that the data collected are used across all Facebook Products for provision and personalisation, including information on the users’ activities on various Facebook Products and devices, to provide the user with a tailored and consistent experience on all Facebook Products wherever they are used; - the provision currently contained in section II of Facebook’s Data Policy under the headline “How do we use this information? Provide measurement, analytics, and other business services” explains that the available information including activities outside of Facebook Products, e.g. websites visited and ads viewed is used to help advertisers and other partners measure the effectiveness and distribution of their ads and services and understand the types of people who use their services and how people interact with their websites, apps, and services; - the provision currently contained in section II of Facebook’s Data Policy under the headline “Promote safety, integrity and security”, “Communicate with you”, “Research and innovate for social good” explains that the available information is used to promote protection, integrity and security, to communicate with the user and to research and innovate for social good; - the provision currently contained in section IV of the printable version of Facebook’s Data Policy under the headline “How do the Facebook Companies work together?” explains that information on the user is processed across the so- called “Facebook Companies” as permitted by applicable law and in accordance with their terms and policies to provide an innovative, relevant, consistent and safe experience across all products provided by the Facebook Companies, which, pursuant to this provision, include Oculus and Oculus Ireland Ltd., WhatsApp Inc. and WhatsApp Ireland Ltd., and Masquerade; - the provision currently contained in Facebook’s Cookies Policy under the headline “Where do we use cookies”, which is referred to in the Data Policy (“What kinds of information do we collect - Device Information”), explains that Facebook places cookies on the computers or devices to receive information stored in cookies when the user uses or visits Facebook Products, Products provided by other members of the Facebook Companies and websites and apps provided by other 4 companies that use the Facebook Products including Facebook Business Tools, and stipulates that Facebook receives this information including device-related information and information on the user’s activities without any further user action once the user visits websites and apps meeting the criteria specified above; - the definition currently given in Facebook’s Cookies Policy under the headline “Cookies & Other Storage Technologies” extending the aforementioned provisions on the use of cookies to other technologies, including the data saved by Facebook on the user’s web browser or device, identifiers linked to that device and other software. 2. The parties 1-3, including any affiliated companies pursuant to Section 36(2) GWB, are prohibited from implementing the Facebook terms of service including the Facebook data and cookies policies within the meaning of paras 1.a. to c., in particular as far as the following aspects are concerned: a. Collection of the phone number indicated by private users upon registration for WhatsApp, their device identifications, operating system versions, app versions, platform information, country code, network code, identifiers allowing to track the user’s agreement with updates and control options and information on when WhatsApp was last used, information on when the account was registered and how and how frequently features were used, and other user and device-related information, and combination of this information with data collected and saved while the users were using Facebook.com, e.g. via a family device ID and matching the information with the users’ Facebook IDs, and use of that information. b Collection of the user and device-related information of private users of Oculus and Masquerade, e.g. account information, content created, meta data, transaction data, payment information, device information, device IDs, cookie and pixel information, information on the use of third-party websites or apps and location data and combination of this information with data collected during their use of Facebook.com, e.g. via Facebook Login, the user’s email address or device IDs, and matching this information with their Facebook IDs, and use of that information. c. The combination of information and content provided by private users of Instagram, their networks and connections on Instagram, information on their use of Instagram, transactions carried out on Instagram, other people’s activities and information others provided on a user, information on the terminal device used for accessing Instagram including device attributes, processes on the device, identifiers, device signals, data from the device settings, network and connections, cookie data and information provided by partners of Instagram with data collected and stored during 5 their use of Facebook.com, e.g. via a family device ID and matching this information with the users’ Facebook IDs, and use of that information. d. Collection of private users’ device information, information on websites visited, purchases made, advertisements viewed and information on usage collected via Facebook Business Tools which are used by advertisers, app developers and publishers (“Facebook Partners”) via the following APIs, - If social plugins are integrated by Facebook Partners to collect, in particular, the IP address, the browser type, the URL, the website visited and the time of visit, as well as the user ID, which is retrieved from the cookie, the website, date and time; if an app is integrated the collection of information on the app provider, the app ID, the operating system used, the device model, screen size, processor cores, total storage space, name and version of the app used, the so-called “User-Agent-String” (browser information), IP address, time zone and the corresponding “SDK events”. - If Facebook Login and Account