Facebook did that, Mundt's office said, by compiling data from its website, apps and Facebook-owned services - along with seemingly any website that has Facebook's "Like" or "Share" buttons, or a Facebook login box built into their pages.
These have gone down badly with Germans, reflecting broader concerns over personal surveillance that dates back to Germany's history of Nazi and Communist rule in the 20th century.
In addition, Facebook said that the transfer of data between services helps to keep users safe.
"We need to be rigorous in tackling the abuse of power that comes with data."
Facebook has said it plans to appeal a decision by Germany's antitrust regulator that would require the social media company to make sharp changes to the way it collects user data across multiple services and websites.
Privacy International's head of advocacy and policy, Tomaso Falchetta, said: "Privacy harms are directly caused by the business models of companies in dominant positions, which can impose excessive collection of data on people who have become "captive users".
"We are carrying out what can be seen as an internal divestiture of Facebook's data", said Andreas Mundt, president of Bundeskartellamt.
The German regulation body that monitors competition has ordered Facebook to stop some of its core activities, unless it gets more explicit user consent (via the BBC). The company could be subject to fines of 10% of its total annual revenue (estimated at US$55.8 billion at the time of writing) if it continues the practices in question.
Brussels-based anti-trust lawyer Thomas Vinje of Clifford Chance said the decision had potentially far-reaching implications. "In the operation of its business model the company must take into account that Facebook users practically can not switch to other social networks", said Mudnt.
"Popularity is not dominance", they complained, in a blog post arguing that less than 60 percent of German social media users use Facebook, "yet the Bundeskartellamt finds it irrelevant that our apps compete directly with YouTube, Snapchat, Twitter and others" - as if controlling over half the market made them an underdog.
European regulators have always been concerned about Facebook's plans to deepen the integrating of WhatsApp. having previously fined Facebook 110 million euros for failing to tell them about the ability to combine the data when they examined the deal.
"We support the GDPR and take our obligations seriously".
Part of the expanded rights of data subjects outlined by the GDPR is the right for data subjects to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, where and for what objective.
Facebook is considering appealing on the data protection issues to the European Court of Justice, but here the Cartel Office may also have the upper hand, said Vinje, the lawyer. Users are more likely to stay within Facebook's properties if they can easily message their friends across different services, rather than having to switch between Messenger, WhatsApp and Instagram.
Facebook has said that discussions on such a move are at a very early stage.