Facebook must stop providing personal data to third-party app makers without getting users' explicit consent, the Federation of German Consumer Organisations (VZBV) said on Tuesday. If Facebook does not comply before next Monday, it could face legal action.
Facebook has long encouraged use of third-party apps on its platform, but with the introduction of the App Center in July its data protection practice worsened instead of improved, the group said on its website Monday. Instead of asking users if it is allowed to share their data, user consent is simply assumed by clicking on the "play game" or "send to phone" button, it added.
Facebook was officially warned by the VZBV that it must comply with the current applicable law, it said.
The VZBV is an umbrella organization representing the 16 consumer centers of the German states as well as 25 other consumer associations.
Facebook does provide a limited list in a small light gray font that describes access that will be granted to an app provider, which includes access to a users' chat, information about friends, personal contact information and the ability to post on a users' Facebook wall.
Providing such an extensive amount of information to a third party is only possible under German law after conscious consent by the user, according to the federation. This leads the consumer organizations to conclude that Facebook "clearly violates" German law, it said.
"We do not exclude taking further legal steps when the ultimatum ends without a declaration of Facebook to change the settings," said Katharina Maria Nocun, policy officer for the VZBV, in an email.
"We hope that the company will try to find a solution that respects the consumer rights and German law," she said, adding that the VZBV sued Facebook in the past over "friend-finder" and unclear formulations in its Terms of Service.
A Facebook spokesman said that the social network was looking into the matter and was not able to provide any further comment.
Facebook is under renewed data protection scrutiny in Germany. Earlier this month the Hamburg Commissioner for Data Protection reopened its proceedings against Facebook's use of facial recognition technology used to suggest whom users should "tag" in photos. Facebook still stores facial profiles of existing users that was gathered without the users' explicit consent.
The social network now has to decide if it wants to get the explicit consent of users for facial recognition, delete the data or face a lawsuit, the commissioner said.