Bundeskartellamt v Meta: off-Facebook data needs separate consent

Using Facebook required allowing Meta to collect data about users outside Facebook and link it to their account. That covered Meta’s other services, such as Instagram, and data collected in third-party apps and on third-party websites. Users could "either agree to an almost limitless amount of data being combined or not use the social network at all".

These are the authority’s findings, now final, as described in its October 2024 press release.

• The authority prohibited Facebook’s terms that made using the network conditional on combining data from other sources.
• Data could only be combined with the user’s "distinct consent, which, however, could not be made a condition for using Facebook".
• The Federal Court of Justice (2020) and the CJEU (2023) confirmed the authority’s position on matters of principle.

The data from third-party sites and apps arrives through what Meta calls its Business Tools, such as the pixel and SDKs that site owners install. This case was about what Meta does with that data once it arrives, not about the sites that sent it.

1. 6 February 2019Bundeskartellamt decision; Meta appeals
2. 2020Federal Court of Justice backs the authority in interim proceedings
3. 7 June 2023Authority announces Meta’s Accounts Centre
4. 4 July 2023CJEU judgment in C-252/21
5. 10 October 2024Meta withdraws its appeal; case closed and decision final

• An Accounts Centre that lets users choose which Meta services to connect.
• "Cookie" settings in Facebook and Instagram that let users refuse linking of data from Business Tools on other sites and apps.
• Facebook Login can still be used by people who refuse that linking.
• Prominent notices for users who agreed to linking in the past, with direct links to the new settings.
• Data combined for security purposes is kept only for a fixed, limited period.

No fine. The cost was product changes and more than five years of proceedings.

For site owners the relevance is indirect. It explains why Meta users can now refuse the linking of pixel data, and it is background to the German damages claims over Meta’s Business Tools. It does not remove a site owner’s own duty to get consent before the pixel loads.

Inth works on your side of the pixel, not inside Meta. A browser observation cannot establish downstream use.

• Consent banner: under the EU opt-in policy, optional tags wait until the visitor chooses. On withdrawal it sends the revocation to each integration and stops loading tags not yet loaded.
• Website audit records what loaded before a choice and after Reject, with page, time, region and consent state.
• Code audit flags a pull request that adds an advertising tag outside the consent check.

In the repository

• List every Meta pixel, SDK and server-side event integration and check each waits for consent.

In the browser and network

• Check for requests to Meta domains before a choice and after Reject.

With the people responsible

• Ask whether your notice explains that Meta may link the data to a user’s account.

• Bundeskartellamt press release, 10 October 2024
• Bundeskartellamt case report B6-22/16 (PDF) (German)
• CJEU, C-252/21

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit Meta’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: Meta Business Tools damages, Meta consent or pay (UK), vzbv v Google