Facebook smartmobe app's pre-ticked privacy settings violate German data protection law

Court favours consumer group in long-running dispute

A German court has ruled that Facebook has not done enough to alert people to the pre-ticked privacy settings on its mobile app.

That included an option to share location data when in conversation with another user, and agreement that Google and other search engines could show links to user profiles in search results.

Facebook said it will appeal against the decision. A spokeswoman said: "We are reviewing this recent decision carefully and are pleased that the court agreed with us on a number of issues. Our products and policies have changed a lot since this case was brought, and further changes to our terms and Data Policy are anticipated later this year in light of upcoming changes to the law.

"We work hard to ensure that our policies are clear and easy to understand, and that all aspects of the Facebook Service are in compliance with applicable law."

The case – a long-running dispute with Verbraucherzentrale Bundesverband (vzbv), or Federation of German Consumer Organisations – dates back to 2015. Facebook said it is planning to update its data protection practices and policy due to GDPR coming into force in May.

Vzbv published a statement on its site, following the judgment issued by Berlin Regional Court.

Heiko Dünkel, legal officer at vzbv, claimed Facebook hid its data presets without sufficiently informing users during registration. "That's not enough for informed consent."

Vzbv said: "The Facebook app for smartphones, for example, a location service was pre-activated that reveals a user's location to people they are chatting to.

"In the privacy settings, ticks were already placed in boxes that allowed search engines to link to the user's timeline. This meant that anyone could quickly and easily find personal Facebook profiles."

The court also ruled eight clauses in Facebook's terms of service to be invalid, including terms that allow Facebook to transmit data to the US and use personal data for commercial purposes. ®