Five of Facebook’s default privacy settings are ‘illegal’, German court finds

A German court has found Facebook is breaching data protection rules with ‘illegal’ privacy settings that over-share by default, a consumer rights organisation said on Monday.

Judges found five different default privacy settings were illegal under German law, including sharing location data with chat partners or making profiles available to external search engines, allowing any internet user to stumble across them.

Requiring users to give real names breaches the data protection rules, plaintiffs the Federation of German Consumer Organisations (VZBV) said.

Under German law, personal information can only be recorded and used by a company with explicit agreement from the individual.

But Berlin judges ruled Facebook leaves many settings switched on by default, failing to offer users a meaningful choice about how their data is used, VZBV said.

Mark Zuckerberg has pledged to ‘fix’ Facebook, but will he really?

“Facebook hides default settings that are not privacy-friendly in its privacy centre and does not provide sufficient information about this when users register,” VZBV legal expert Heiko Duenkel explained.

The court also ruled eight paragraphs of Facebook’s terms of use were invalid, most notably one which requires people to use their real names on the social network.

But it did not agree with the consumer advocates’ claim that the firm’s slogan “Facebook is free and always will be” was misleading.

The VZBV said users were already paying to use the site – but with access to their data, rather than cash.

Facebook could face fines of up to 250,000 euros (US$306,000) per infraction if it does not fix its conditions in Germany, but the company said it would appeal the ruling.

“Our products and terms of service have changed a lot since the beginning of the case, and we are making further changes this year to our terms of use and data protection guidelines, with a view to upcoming legal changes,” a spokeswoman said.

Why Facebook is in a French court for censoring a vagina painting

Germany is a major market for Facebook in Europe, with around 30 million of the country’s 80-million strong population signed up and almost 23 million using the network every day.

Along with Austria, it is one of the only European Union nations to have translated continent-spanning rules known as the General Data Protection Regulation (GDPR) into national law ahead of a May 25 deadline.

Monday’s judgment follows a December warning from Germany’s competition watchdog that Facebook was abusing its dominant market position to “limitlessly” harvest data from outside websites and apps.

The social network uses its connections to third-party websites and subsidiaries WhatsApp and Instagram to collect data on its users to enable hyper-targeted advertising.