The Federation of German Consumer Organizations (VZBV) accused the Facebook-owned image-sharing service of breaking German data protection law and trying to force unfair terms on German consumers. It said the firm has until November 2 to change its terms, and has until the end of the year to improve its privacy practices.

According to a report in Der Spiegel, Instagram is currently formulating new terms in order to ensure compliance with local law.

So what is Instagram doing wrong? The first problem, according to the watchdog, is that Instagram’s terms allow it to pass people’s personal data to advertisers without their explicit consent. The VZBV said the clauses allowing this were worded too vaguely to comply with data protection law.

Instagram’s terms also say that any complaints must, if necessary, go to arbitration in California—not a practical option for regular people in Europe. What’s more, Instagram claims rights over the content posted by its users, and retains broad discretion to block photos, videos and entire profiles.

“Instagram has granted itself rights regarding its mostly young users that are far too broad,” VZBV chief Klaus Müller said in a Monday interview with Tagesspiegel. “I don’t think any user knew what was in the small print.”

Companies find it much harder in Europe than in the U.S. to get customers to sign away their rights through terms and conditions. European law places strong emphasis on fundamental rights that contracts cannot nullify—and data protection is one of them.