Germany's antitrust agency is hitting Facebook with "far-reaching restrictions" on the social media network's practice of merging its users' data that was gleaned from WhatsApp, Instagram and millions of third-party websites and apps. The decision can be appealed; if it stands, it would force Facebook to add more ways for its users to protect their privacy.

"In the authority's assessment, Facebook's conduct represents above all a so-called exploitative abuse," said the Bundeskartellamt, or Federal Cartel Office. Andreas Mundt, the office's president, said on Thursday that Facebook "was able to build a unique database for each individual user and thus to gain market power."

Facebook did that, Mundt's office said, by compiling data from its website, apps and Facebook-owned services — along with seemingly any website that has Facebook's "Like" or "Share" buttons, or a Facebook login box built into their pages. Even if a website has no visible signs of a link to Facebook, it could still send user data to the company by using the Facebook Analytics service in the background.

People are subject to the data tracking, the German agency says, "even if users have blocked web tracking in their browser or device settings." It adds that the integration of Facebook interfaces also allows the company to track people's online behavior, "even if they are not logged into or registered with Facebook."

Through those practices, Facebook has been able to build profiles of its users that are far more complete than if it relied solely on recording their activities within the social network. And it was done, Mundt said, without users providing their voluntary and affirmative consent.

"German authorities called it an abuse of Facebook's market dominance and ordered the social network to restrict the practice and stop it completely within a year," NPR's Daniel Estrin reports for the Newscast unit from Berlin.

The competition watchdog's order stems from a roughly three-year investigation. In response, Facebook says it disagrees with the order and will appeal.

"Popularity is not dominance," the company said, accusing the Federal Cartel Office of underestimating "the fierce competition we face in Germany" and failing to recognize how Facebook complies with Europe's General Data Protection Regulation, which took effect last spring.

The Federal Cartel Office says Facebook's subsidiaries such as WhatsApp and Instagram can continue to collect data, but the information cannot be merged with Facebook users' profiles unless they have given their voluntary consent. It's also calling on Facebook to change its terms of service, calling them overly broad and inappropriate.

It is not enough, Mundt said, for Facebook to require that consent as part of its terms of service. Instead, he said, its German users must be allowed to opt out of data collecting and processing while still using Facebook's network and services.

In its response, Facebook said that its practice of merging its users' information across platforms and sites allows it both to improve its service and to "protect people's safety." As an example, it cited "identifying abusive behavior and disabling accounts tied to terrorism, child exploitation and election interference across both Facebook and Instagram."

The U.S. tech giant has one month to lodge an appeal with the Düsseldorf Higher Regional Court. If the Federal Cartel Office's decision stands, Facebook would be required to lay out a plan for implementing the new restrictions.

Facebook has been under increasing scrutiny for its approach to user privacy and data collection, from the sharing of information with the Cambridge Analytica data firm in the lead-up to the 2016 U.S. presidential election to its refusal to share users' data with competitors.

Editor's note on March 1: For the record, Facebook is among NPR's financial supporters.

Copyright 2021 NPR. To see more, visit https://www.npr.org.