What changes when one company runs several of your apps?

The short answer

When one company runs your email, maps, photos and messages, it can link what it learns in each one. Some of these companies say so in their own privacy policies. In the EU, a court and a law now set rules on when that linking needs your consent.

What "combining data" means

Each app you use collects some personal data: what you search, where you go, who you write to. "Combining" means joining those pieces into one record about you. A company that runs several services can join data from all of them. Data from other websites can be joined too, through cross-site tracking.

What the companies say

• Google says it may use the information it collects across its services and across your devices. (Google)
• Meta says that for some purposes it uses information across its products from the accounts you add to Accounts Center, and that it shares information with the other Meta companies. (Meta)
• Microsoft says it combines data collected from different contexts or obtained from third parties. (Microsoft)
• Apple says it may share personal data with Apple-affiliated companies, and that it sometimes combines non-personal data from cookies and similar tools with other personal data it holds. (Apple)
• Amazon: we are still checking. Its privacy notice did not open for us on the check date.

What regulators and courts decided

• Germany, 7 February 2019. The Federal Cartel Office (Bundeskartellamt) decided that Facebook may link data from WhatsApp, Instagram and other websites to Facebook accounts only with the user's voluntary consent. It also said Facebook may not exclude users who refuse. (Bundeskartellamt)
• EU Court of Justice, 4 July 2023 (case C-252/21, Meta Platforms v Bundeskartellamt). The court ruled that a national competition authority can find that a company's terms break the GDPR, when that is needed to show abuse of a dominant position. It also set conditions under which a social network can rely on "legitimate interests" to link data from its other services and from other websites and apps to a user's account. (EUR-Lex)
• EU Digital Markets Act (Regulation (EU) 2022/1925), Article 5(2). Companies named "gatekeepers" may not combine personal data from one of their listed services with data from their other services, or from third-party services, unless the user was given a specific choice and gave consent. If the user says no, the company may ask again for the same purpose no more than once a year. (EUR-Lex)
• Who the gatekeepers are. The European Commission designated Alphabet, Amazon, Apple, ByteDance, Meta and Microsoft on 6 September 2023, and Booking on 13 May 2024, each for named services. (European Commission)

These rules apply in the EU. Elsewhere, the rules depend on the country.

What you can do

These are options. Which ones fit is your call.

• Spread your apps across companies. Using different companies for email, search, maps and messages means no single one holds all of it.
• See where you stand. The Portfolio builder's What do you use today? counts your apps by the company that owns them. It runs in your browser.
• Look at alternatives. The swap page lists other apps for each Big Tech service, with the proof for each one.
• Check your settings. In the EU, Article 5(2) above says gatekeepers must give a specific choice before combining data across their listed services, with some legal exceptions. You can review those choices in each account.