Germany's data protection regulator on Tuesday ordered Facebook to stop collecting and storing data from WhatsApp users in the country.
Facebook also must delete any data it already may have harvested from German WhatsApp users, according to Johannes Caspar, Hamburg Commissioner for Data Protection and Freedom of Information, who issued the order.
Even though Facebook purchased WhatsApp two years ago, they are two independent companies, noted the commissioner, and WhatsApp can not share data with Facebook without first obtaining a user's consent.
What WhatsApp and Facebook have been doing not only misleads users, but also violates German law, the commissioner maintained.
"This administrative order protects the data of about 35 million WhatsApp users in Germany," Caspar said. "It has to be their decision, whether they want to connect their account with Facebook. Therefore, Facebook has to ask for their permission in advance. This has not happened."
"Facebook complies with EU data protection law. We will appeal this order and will work with the Hamburg DPA in an effort to address their questions and resolve any concerns," the company said in a statement provided to the E-Commerce Times by spokesperson Anne Yeh.
If Facebook is tapping into WhatsApp data, that appears to violate a pledge it made when it bought the service.
"When Facebook and WhatsApp came together, they made a statement that they would not share data," said Karen North, director of the USC Annenberg's Digital Social Media program.
It's easy to understand why Facebook would want access to WhatsApp data.
"You have access to people's phone numbers, locations and conversations," North told the E-Commerce Times. "For targeting ads and other activities, having the data from WhatsApp could be a huge asset for the strategic planning of Facebook."
Politics may have had a hand in Germany's move against Facebook and WhatsApp, maintained Jim McGregor, founder and principal analyst at Tirias Research.
"Europeans see big American companies dominating the Internet, and he who has the information has the power, so there's some concern there politically," he told the E-Commerce Times.
"Sometimes politicians have to show they're doing something, and sometimes the best way to do that is to pick on the big guys," McGregor said.
"How much of this is driven by the people?" he asked. "Very little."
This skirmish in Germany could be just the start of trouble for Facebook, observed Andreas Scherer, managing partner at Salto Partners.
"This will be an uphill battle for Facebook," he told the E-Commerce Times.
"It's safe to assume that regulators in other European jurisdictions will take a hard look at the situation," he said. "So, this could be just the beginning of the Facebook WhatsApp data-sharing saga."
For the time being, though, other countries appear content to see how the scenario plays out in Germany.
"Data privacy authorities in France and the UK are monitoring the policy change, but it's unclear that they will follow suit," said Samantha Merlivat, an analyst in Forrester Research's London office.
"They seem to be monitoring what happens with Germany before taking action," she told the E-Commerce Times.
Since the adoption of the General Data Protection Regulation earlier this year, data protection is very much in focus at the moment, and privacy rules are expected to tighten in the next 18 months, Merlivat said.
Whether or not a Facebook appeal can flip the Hamburg commissioner's order, the decision isn't likely to damage the company's business in Germany or Europe, maintained Jan Dawson, chief analyst at Jackdaw Research.
"This will have a minimal impact on Facebook's German operations," he told the E-Commerce Times.
"Those operations have functioned just fine until now without having access to the WhatsApp data, and although I'm sure it would have been useful for Facebook to have access to the additional WhatsApp data, it's not critical to its future success," Dawson said.
Since the ruling affects only German users, it will have very little impact on Facebook's global business, of which Germany is only a small fraction.
"Germany has always taken a particularly strict approach to data protection, and so I suspect this will be more of an outlier than a bellwether," Dawson suggested. "I would be surprised if more than one or two other European countries take a similar approach."