The authority said that the extent of Facebook’s collection, merging and use of data constituted an abuse of its dominant position.

It has ruled that Facebook can no longer assign data from third-party sources – both services it owns, such as WhatsApp and Instagram, and websites which include ‘Like’ or ‘Share’ buttons – to Facebook user accounts, without the user’s voluntary consent.

If consent is not given, the data must not be processed in combination with Facebook data, the Bundeskartellamt said.

Andreas Mundt, president of the Bundeskartellamt, said: “With regard to Facebook’s future data processing policy, we are carrying out what can be seen as an internal divestiture of Facebook’s data. In future, Facebook will no longer be allowed to force its users to agree to the practically unrestricted collection and assigning of non-Facebook data to their Facebook user accounts.”

The ruling is not yet final. Facebook has a month to appeal the decision, and said it intends to do so. The company wrote in a blog post: “While we’ve cooperated with the Bundeskartellamt for nearly three years and will continue our discussions, we disagree with their conclusions and intend to appeal so that people in Germany continue to benefit fully from all our services.”

Facebook added: “The Bundeskartellamt underestimates the fierce competition we face in Germany, misinterprets our compliance with GDPR and undermines the mechanisms European law provides for ensuring consistent data protection standards across the EU.”