Germany's federal cartel office has expressed concerns about the way Facebook collects and sells user data, and warned it to come up with a "solution" — or face sanctions.

"We have informed the company that we believe it is dominating the market. And we criticize the way the company collects and exploits personal data as a possible abuse of its market power," cartel office President Andreas Mundt told the Rheinische Post newspaper on Tuesday.

He specifically criticized the way the US social network, which has around 31 million users in Germany, mines data from outside its own site. "On the one side the social network offers an apparently free service, on the other it offers attractive advertising space, whose value is so high because Facebook controls vast amounts of personalized data," he said. "But Facebook has to abide by the rules and laws."

Mundt went on to warn the company that it could face sanctions if it didn't change certain methods. "Now we will see how Facebook reacts to our criticism. Then we will decide what to do," he said. "Maybe Facebook will suggest some solutions and commit to a different practice. Or maybe in the end we will have to ban the collection and use of data from third sources without the express agreement of users." Mundt went on to say that though Facebook's European operations are based in Ireland, it still comes under the cartel office's jurisdiction because German consumers are affected.

A new investigation

It is well-known how Facebook's ultra-lucrative business model works, and that it collects user data from its subsidiary services like WhatsApp and Instagram in order to personalize ads. Facebook made $26.9 billion (€22.4 billion) in advertising revenue worldwide in 2016, virtually all of its total revenue. This is the first time that the cartel office has announced an investigation into whether Facebook is dominating the social media market in Germany and has asked the company to explain its practices.

Facebook's press office did not immediately respond to a DW request for comment, but told the Rheinische Post that while the company rejected Mundt's criticism, it would cooperate with the cartel office.

"The current assessment by the Federal Cartel Agency is very much to be welcomed," digital rights lawyer Christian Solmecke told DW. "We hope that Facebook will begin to offer solutions now — maybe by providing more information on its data collection practices and installing more control options for users so that people can limit data collection."

Solmecke also believes that "in their current form," Facebook's methods are already a violation of Germany's data protection laws, and that the cartel office will be working on the assumption that users are "not sufficiently informed about the kind and extent of the data collection and therefore cannot effectively agree to it."

"A cartel office assessment is relatively labor-intensive," said Lina Ehrig, who heads the digital and media team at the Federation of German Consumer Organizations (VZBV). "It could be that the cartel office did not have the capacity to carry out the assessment before. But it's not as trivial as one might think."

The VZBV, which welcomed the cartel office's investigation, is also involved in the process as a partner representing the interests of consumers. "A huge number of consumers are affected by it; it's about people's private lives and protecting their data," said Ehrig.

Knowing where your data is

The European Union has clear rules on how personal data may be used, which are enshrined in the 2016 data protection directive. This directive largely used German data laws as a model, and says, "Persons or organizations which collect and manage your personal information must protect it from misuse and must respect certain rights of the data owners which are guaranteed by EU law."

"Just because people use Facebook and think of it as an interesting and nice application, doesn't mean it is allowed to just use the data for whatever it wants," said Ehrig.

She also points out that the cartel office is more powerful than German government's data protection watchdogs, saying that utilizing cartel law rather than data protection laws raises the possibility of tougher sanctions, perhaps including banning certain data-collection practices. "The cartel office certainly has more power than we do — I think this could have a big effect on Facebook," she said. "At least I hope so."

Facebook will have the right to appeal any sanctions in court, meaning it could take a long time for any changes come into effect.