CJEU Meta v Bundeskartellamt
In Meta v Bundeskartellamt, the CJEU held on 4 July 2023 that competition authorities may examine GDPR compliance when assessing abuse of dominance, subject to cooperation with data protection authorities. The Grand Chamber also clarified legal bases for data-driven business models. This briefing explains the case, the holdings, the German outcome and the lessons for businesses.
Key takeaways
- The CJEU Grand Chamber decided Meta Platforms v Bundeskartellamt (C-252/21) on 4 July 2023.
- Competition authorities may find GDPR breaches when examining an abuse of dominance under Article 102 TFEU.
- They must cooperate with data protection authorities and may not depart from their decisions.
- Contractual necessity covers only processing objectively indispensable to the service.
- Dominance does not exclude valid consent but is an important factor for whether it is freely given.
What Meta v Bundeskartellamt decided
In Meta v Bundeskartellamt (C-252/21), decided by the Grand Chamber on 4 July 2023, the Court of Justice of the EU confirmed that a national competition authority may, when examining whether a dominant company abuses its position, find that the company's terms on the processing of personal data do not comply with the General Data Protection Regulation (GDPR). The competition authority does not thereby replace data protection authorities: it must cooperate sincerely with them, may not depart from their decisions on the same or similar terms and must consult them where in doubt.
The Court also gave important guidance on the GDPR legal bases for data-driven business models, from contractual necessity to legitimate interests and consent.
The judgment arose from the Federal Cartel Office's (Bundeskartellamt) landmark decision of 6 February 2019 against Facebook, which prohibited the combination of user data from Facebook, other group services and third-party websites and apps without users' consent, as an abuse of dominance under § 19(1) of the Act against Restraints of Competition (GWB). Meta v Bundeskartellamt is therefore both a competition law and a data protection law precedent, and it remains central to how authorities in Germany and the EU approach digital platforms.
Background: the Facebook proceedings in Germany
The Bundeskartellamt found that Facebook was dominant in the German market for private social networks and that its terms of use, which allowed it to collect data from other group services such as Instagram and WhatsApp and from third-party sites through interfaces and cookies, and to combine those data with the user's Facebook account, were an exploitative abuse. Its reasoning relied on the values of the GDPR as a benchmark for assessing whether the terms were appropriate.
Facebook appealed to the Higher Regional Court (Oberlandesgericht) of Düsseldorf, which had doubts about whether a competition authority may assess GDPR compliance and about the GDPR questions themselves, and referred them to the CJEU by decision of 24 March 2021.
In parallel, the Federal Court of Justice (BGH) had confirmed in interim proceedings in 2020 that the Bundeskartellamt's decision could be enforced, using a different reasoning based on the imposed extension of services and the lack of user choice. Our note on the BGH Facebook decision explains that order.
Competition authorities may examine GDPR compliance
The Court's first and most important answer concerns institutional competence. It held that Article 51 et seq. GDPR and the duty of sincere cooperation in Article 4(3) TEU allow a competition authority, in an abuse case under Article 102 TFEU, to find that a dominant company's data processing terms and their implementation are not consistent with the GDPR, where that finding is necessary to establish an abuse. The GDPR does not reserve this question exclusively to data protection authorities, because the competition authority acts under competition law and does not impose GDPR sanctions.
The power comes with conditions. The competition authority cannot depart from a decision of the competent data protection authority, or the lead supervisory authority under the one-stop-shop mechanism, concerning the same or similar terms.
If it has doubts about the scope of such a decision, if the terms are under examination by those authorities, or if there is no investigation or decision, it must consult them and seek their cooperation. If those authorities do not object or respond within a reasonable time, it may continue its own investigation. In Germany, this principle has since been reflected in cooperation between the Bundeskartellamt and data protection authorities, and the logic extends to new competition law tools such as § 19a GWB for digital gatekeepers.
Guidance on GDPR legal bases in Meta v Bundeskartellamt
The Grand Chamber used the case to clarify the GDPR legal bases for personalised services and data combination. Its main holdings are summarised below.
| GDPR provision | Court's interpretation |
|---|---|
| Article 9(1) and (2)(e): sensitive data | Collecting data about visits to websites or apps revealing sensitive information is processing of special categories; such data are not "manifestly made public" merely by visiting, although they may be by deliberately clicking "Like" or "Share" or logging in |
| Article 6(1)(b): contract | Processing is necessary for a contract only if objectively indispensable for a purpose integral to the contractual obligation, so that the main subject matter cannot be achieved without it |
| Article 6(1)(f): legitimate interests | Requires information on the legitimate interest, strict necessity and a balancing; personalised advertising based on such extensive data generally does not outweigh users' interests without consent |
| Article 6(1)(c), (d), (e) | Legal obligation, vital interests or public interest can justify such processing only in narrow circumstances |
| Article 6(1)(a): consent | A dominant position does not as such preclude valid consent, but it is an important factor for whether consent is freely given, which the controller must prove |
The statements on contractual necessity and legitimate interests have had the widest impact. Personalised advertising, the Court said, cannot simply be justified as necessary for a free social network service, and users must be informed of the specific legitimate interest when data are collected.
The remark on consent and dominance, that users should be able to refuse particular processing operations not necessary for the contract without having to give up the service entirely, if necessary for an appropriate fee, prompted the "pay or consent" models introduced by large platforms in Europe. The Court's wording was that users should be offered, if necessary for an appropriate fee, an equivalent alternative without such processing operations. Whether a particular fee-based model meets that test remains contested before data protection authorities and, for gatekeepers, under the Digital Markets Act.
Do not rely on contractual necessity for processing that serves advertising, analytics or product improvement. After Meta v Bundeskartellamt, authorities expect such processing to rest on consent or a carefully documented legitimate interest assessment, and dominant companies must expect stricter scrutiny of whether consent was freely given.
Sensitive data, tracking and third-party websites
Meta v Bundeskartellamt also addressed the collection of data from third-party websites and apps through interfaces, cookies and similar technologies. The Court held that where a user visits websites or apps relating to categories listed in Article 9(1) GDPR, such as health, sexual orientation, political opinions or religious beliefs, and the platform operator collects data about those visits, links them to the user's account and uses them, this can amount to processing of special categories of personal data. That applies where the processing allows information falling within one of those categories to be revealed, regardless of whether the information concerns a user of the network or another natural person. Such processing is prohibited unless an exception in Article 9(2) GDPR applies.
The Court rejected the argument that users "manifestly make public" such data simply by visiting a website or app. Only where users deliberately make information public, for example by clicking a "Like" or "Share" button on a page or by logging in with their social network credentials, with the explicit intention of making it accessible to an unlimited number of persons, may the exception in Article 9(2)(e) apply, and even then individual privacy settings matter.
This part of the judgment is relevant for every company that embeds third-party tracking tools, social plugins or software development kits in its websites and apps. Website operators can be joint controllers for the collection through such tools and need a valid legal basis, which for tracking will generally be consent under the rules on cookies and the GDPR.
The enforcement landscape after the judgment
The judgment has encouraged authorities to look at data practices from several angles. Data protection authorities in Europe, coordinated through the European Data Protection Board, have examined the legality of behavioural advertising and fee-based alternatives. The European Commission applies the Digital Markets Act, which in Article 5(2) restricts gatekeepers from combining personal data across services without consent. The Bundeskartellamt uses its powers under § 19a GWB in proceedings against several large digital companies. For businesses, this means that the same data practice can be challenged in multiple procedures with different remedies, from fines to behavioural obligations.
The outcome of the German proceedings
Following the CJEU judgment, the Düsseldorf proceedings did not lead to a further judgment on the merits. According to the Bundeskartellamt's annual review of December 2024, it concluded its Facebook case in 2024 with a set of measures that give users much better options for deciding how their data are combined, and its decision is now final. In practice, Meta introduced choices for users about combining data across services and from external sources. The case thus ended more than five years after the original decision, with a result that combined competition and data protection objectives.
For the Bundeskartellamt, the case validated an enforcement approach that it has since developed under § 19a GWB, which allows it to designate companies of paramount significance for competition across markets and to prohibit specific practices, including certain forms of cross-service data processing without sufficient choice. At EU level, the Digital Markets Act now contains a similar prohibition on combining personal data across core platform services without consent for designated gatekeepers.
Lessons for businesses beyond big tech
Meta v Bundeskartellamt matters for companies that are not gatekeepers. The judgment's interpretation of the GDPR legal bases applies to every controller. Retailers with loyalty programmes, publishers with personalised advertising, app providers and connected device manufacturers should check whether they rely on contractual necessity for processing that goes beyond what is indispensable to their service, and whether their legitimate interest assessments meet the standard set by the Court. Companies with strong market positions in their sector should also be aware that data practices can be examined under competition law, not only by data protection authorities.
The judgment also shows that regulatory risks overlap. A single data practice may be reviewed by data protection authorities, competition authorities and, under the Digital Services Act and Digital Markets Act, by the European Commission. Coordinated compliance, in which data protection, competition and regulatory teams assess new data uses together, reduces the risk of inconsistent positions in parallel proceedings and of commitments in one forum being used against the company in another.
How TRW & Co helps
We advise companies on the intersection of data protection and competition law. We review legal bases for data-driven business models, design consent and choice architectures, assess market power and abuse risks, and represent clients before the Bundeskartellamt, data protection authorities and the courts. Our work draws on our antitrust, GDPR and digital platforms practices; see also our notes on § 19a GWB and the Digital Markets Act. Please contact us to discuss your data strategy. This briefing is general information and not legal advice.
Frequently asked questions
Can the Bundeskartellamt enforce the GDPR?
Not as such. It cannot impose GDPR sanctions, but the CJEU held that, when examining an abuse of dominance, a competition authority may find that data processing terms do not comply with the GDPR if necessary to establish the abuse. It must respect decisions of data protection authorities on the same or similar terms and consult them where in doubt.
What did the court say about personalised advertising?
Personalised advertising based on extensive data combined across services and third-party sites cannot simply be justified as necessary for the performance of the contract. Under legitimate interests, the controller must inform users of the specific interest and the balancing generally weighs against such extensive processing without consent.
Can users of a dominant platform give valid consent?
Yes. Dominance does not as such preclude valid consent under the GDPR, but it is an important factor in assessing whether consent was freely given, which the controller must prove. Users should be able to refuse processing that is not necessary for the service without losing access entirely, if necessary for an appropriate fee.
How did the German Facebook case end?
After the CJEU judgment in Meta v Bundeskartellamt, the Bundeskartellamt concluded its Facebook case in 2024 with measures giving users better choices about how their data are combined, and its 2019 decision became final, according to the authority’s annual review of December 2024.
Does the judgment matter for smaller companies?
Yes. Its interpretation of GDPR legal bases applies to all controllers. Any company relying on contractual necessity or legitimate interests for advertising, profiling or data combination should review its documentation. Companies with strong market positions should also consider that data practices can be examined under competition law.
Sources
General information only, not legal advice. References to statutes, courts and authorities describe published law and practice at the date shown.
Court Decisions
BGH on Written-Form Cure Clauses in Leases
Written form cure clauses were meant to protect long-term commercial leases against early termination for form defects. In 2017 the BGH held them void under §… 8 min read
Court Decisions
UPC Mannheim: Panasonic v Oppo and FRAND
Panasonic v Oppo is the first UPC decision on a FRAND defence. On 22 November 2024 the Mannheim local division granted Panasonic an injunction for five… 8 min read
Court Decisions
UPC Court of Appeal: Ocado v AutoStore on Public Access
In Ocado v AutoStore, the UPC Court of Appeal held on 10 April 2024 that members of the public can obtain access to written pleadings and… 8 min read