Following a three-year probe into the company, Germany's Bundeskartellamt, or Federal Cartel Office, ruled that Facebook can no longer combine user data from different sources without voluntary consent.
"In future, Facebook will no longer be allowed to force its users to agree to the practically unrestricted collection and assigning of non-Facebook data to their Facebook accounts", Cartel Office Chief Andreas Mundt said.
"Users are often unaware of this flow of data and can not prevent it if they want to use the services", Justice Minister Katarina Barley told Reuters news agency, welcoming the ruling.
The FCO's justification for the case is that it believes Facebook abused its market dominance to gather the data.
Facebook claims the Federal Cartel Office has overstepped the mark by pursuing a data privacy matter that Facebook says falls under the remit of another regulator.
The EU introduced its General Data Protection Regulation (GDPR) in May previous year, intensifying regulators' focus on Facebook.
"By combining data from its own website, company-owned services and the analysis of third-party websites, Facebook obtains very detailed profiles of its users and knows what they are doing online", Mundt said.
"On the one hand there is a service provided to users free of charge", Cartel Office president Andreas Mundt said.
The order applies to data collected by Facebook-owned platforms such as WhatsApp and Instagram, but also third-party sources - such as websites with an embedded Facebook "like" or share button - which Zuck and co use to track people who aren't even signed up to the social network.
It aims to strengthen and unify data protection for all individuals within the European Union (EU). On the other hand, the attractiveness and value of the advertising spaces increase with the amount and detail of user data.
'The Bundeskartellamt has overlooked how Facebook actually processes data and the steps we take to comply with the GDPR, ' Facebook said on Thursday.
Facebook announced it will appeal the decision, lamenting the "fierce competition we face in Germany" and insisting the company is in compliance with both the GDPR and other European data protection laws.
"It seems to me that the Federal Cartel Office is informed by data protections, but not dependent on them, and that it has based its decision squarely on competition law", he said".
Mundt also expressed concern over reports that Facebook, which counts 2.7 billion users worldwide, plans to merge the infrastructure of its Messenger, WhatsApp and Instagram services. "Yet the Bundeskartellamt's decision misapplies German competition law to set different rules that apply to only one company", Facebook said in its blog.
The restrictions are described as "far-reaching", with the watchdog having said that "the extent to which Facebook collects, merges and uses data in user accounts constitutes an abuse of a dominant position".
It noted that it had been cooperating with the office in its investigation since 2016, and will continue discussions, but would also 'defend these important arguments in court'.
In its order, the Cartel Office said it would only be possible to assign data from WhatsApp or Instagram to Facebook subject to the voluntary consent of users.