Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The Court of Justice of the European Union (CJEU) ruled on 4 July 2023 that a competition authority may examine whether a dominant platform’s data processing complies with the GDPR when deciding whether the platform abused its market power. The judgment allowed Germany’s Federal Cartel Office (Bundeskartellamt) to pursue its case against Meta, but it did not find Meta guilty of a GDPR violation, impose a fine, or ban targeted advertising.
The German proceeding was later closed in October 2024 after Meta withdrew its appeal and introduced measures giving users more control over combining data. That closure made the original German decision final, but it did not declare all of Meta’s data practices lawful.
What the EU court decided
In Meta Platforms and Others, Case C-252/21, the CJEU held that a competition authority can consider GDPR compliance as part of an abuse-of-dominance analysis. The authority may assess whether data processing is compatible with relevant GDPR rules when that assessment helps determine whether a dominant company imposed exploitative conditions.
That power has limits. The competition authority must cooperate with the competent data-protection supervisory authority and take account of that regulator’s decisions or ongoing investigations. Antitrust agencies do not become general-purpose GDPR enforcers.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems#1 Best Overall
The judgment was issued after the Higher Regional Court of Düsseldorf asked the CJEU to clarify the legal questions in the Bundeskartellamt’s case. The CJEU’s case record is available at Case C-252/21, and the court’s explanation of the ruling is in its press release.
What Meta’s data practice involved
The Bundeskartellamt’s 2019 order concerned Facebook’s ability to combine data from several sources:
- activity generated on Facebook;
- information from Meta services such as Instagram and WhatsApp; and
- “off-Facebook” information collected through third-party websites and apps.
The authority objected to making use of Facebook conditional on accepting broad collection and combination of that information. In its view, consent was not genuinely voluntary when the alternative to accepting the terms was losing access to the social network. The authority’s description of the proceeding and its later status appears on its Meta/Facebook case page.
Why a privacy practice became an antitrust issue
This was not simply a dispute about whether Meta had committed a standalone privacy violation. The Bundeskartellamt’s theory, as described by the authority, connected market power to the terms users were offered:
Rank #3
- Meta was alleged to hold a dominant position in the relevant social-network market.
- That position could let it impose data terms users might reject from a company facing stronger competition.
- Combining data across services and outside sites could strengthen Meta’s data advantage and reinforce its competitive position.
- GDPR principles therefore supplied relevant evidence for deciding whether the conduct was exploitative under competition law.
The significance is institutional as well as substantive: privacy terms can be relevant to digital-market competition cases, while specialist privacy regulators retain their own authority. The Bundeskartellamt described the ruling’s wider importance in its 4 July 2023 statement.
What the judgment did not do
- No EU fine: the CJEU imposed no penalty on Meta.
- No final GDPR finding: the court did not itself rule that Meta had violated the GDPR.
- No blanket data ban: it did not prohibit all off-platform collection, cross-service linking, or targeted advertising.
- No unlimited antitrust power: competition authorities must stay within their competition-law mandate and coordinate with data-protection authorities.
- No ruling on every consent model: a finding that consent may not be voluntary for a dominant platform in this context does not invalidate every data-consent mechanism.
What happened after the 2023 ruling
The CJEU decision cleared a major legal obstacle; it was not the end of the German case. In October 2024, Meta and the Bundeskartellamt agreed on implementation measures. Meta withdrew its appeal before the Düsseldorf court, making the original German decision final, and the authority closed its proceeding after judging the package sufficiently effective.
| Date | Development | Practical meaning |
|---|---|---|
| February 2019 | Bundeskartellamt issued its original order. | Facebook was told not to condition access on the disputed broad data combination. |
| 4 July 2023 | CJEU delivered its judgment in Case C-252/21. | Competition authorities may consider GDPR compliance in an abuse-of-dominance inquiry, subject to cooperation with privacy regulators. |
| October 2024 | Meta withdrew its appeal and implemented agreed measures; the Bundeskartellamt closed the proceeding. | The German decision became final, with stronger user choice over linking data. |
The authority said the measures give users more control over whether information from outside Facebook—including data from other Meta services and third-party sites or apps—is linked to their Facebook account. That is not the same as ending data collection, eliminating tracking, or abolishing Meta’s advertising model. The closure announcement is set out in the Bundeskartellamt’s 10 October 2024 release.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What this means for users and businesses
For users
The practical effect is greater control over combining data from Meta services and external sources. Users should not interpret the ruling as a promise that Meta stopped collecting information or stopped using data for advertising; the documented change concerns choice over linking and combination.
Best Value
For businesses and platforms
A dominant platform’s privacy terms can create competition-law exposure as well as GDPR risk. Compliance reviews should examine whether consent is genuinely voluntary, how data combination affects rivals and users, and how the company will document cooperation with privacy regulators. Similar facts could also attract scrutiny under the GDPR, the Digital Markets Act, consumer-protection law, or more than one regime at once.
Separate from Meta’s later “pay-or-consent” disputes
The 2019 German case focused on cross-service and off-platform data combination as a condition of Facebook access. Later disputes over Meta’s subscription-based ad-free option involve different questions under the GDPR, the Digital Markets Act, and consumer law. The Bundeskartellamt’s 2024 statement noted that the legality of that model remained contested, including criticism from the European Data Protection Board and preliminary European Commission findings. Those matters should not be treated as outcomes of Case C-252/21.
The Bottom Line
Bottom line: The CJEU confirmed that privacy-related data practices can be evidence in an abuse-of-dominance case, while preserving the leading role of data-protection regulators. Meta lost its challenge to the German authority’s power in 2023; the German proceeding was ultimately closed in 2024 after user-choice measures and withdrawal of Meta’s appeal—not because the court declared Meta’s broader data-driven advertising system lawful.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
