View all newsletters
Receive our newsletter - data, insights and analysis delivered to you
  1. Policy
July 29, 2019

Does Your Website Have a Facebook “Like” Button? Top EU Court Says You’re Responsible for FB’s Personal Data Processing

"This is a very broad interpretation which is likely to seriously impact a large number of website operators"

By CBR Staff Writer

Does your business have a Facebook “Like” button embedded on its website? If so, it is now considered liable for the data Facebook collects and processes even if users don’t click it, under a shock ruling by Europe’s top court today that could have “serious implications” for businesses and seriously dampen the use of such buttons.

The opinion by the Court of Justice of the European Union (ECJ) came after a German consumer group sued online fashion retailer Fashion ID for breaching personal data protection rules by using the button on its homepage: a German court sought guidance and the ECJ now says it shared joint responsibility with Facebook.

” The reason why Fashion ID seems to have consented, at least implicitly, to the collection and disclosure by transmission of the personal data of visitors to its website by embedding such a button on its website is in order to benefit from that commercial advantage. Thus, those processing operations appear to be performed in the economic interests both of Fashion ID and of Facebook Ireland,” the ECJ determined.

Data about website visitors is sent to Facebook “without that visitor being aware of it and regardless of whether or not he or she is a member of the social network Facebook or has clicked on the ‘Like’ button”, the ECJ noted sharply.

“Fashion ID can be considered to be a controller jointly with Facebook Ireland in respect of the operations involving the collection and disclosure by transmission to Facebook Ireland of the data at issue”, the judges said.

Facebook Like Button Makes Websites Jointly Responsible for Data Processing… 

The decision comes days after Facebook was fined a record $5 billion by the US Federal Trade Commission (FTC) for misleading users about what it does with their data: despite the hefty fine, the agreement does not limit how Facebook collects, uses, and shares users’ personal information and is expected to have minimal impact on its ad business.

Tanguy Van Overstraeten, Global Head of Data Protection at Linklaters, said: “Today’s judgment confirms the broad approach adopted by the CJEU last year (Jehovah Witness and Facebook fan page cases), while going further and broadening even more the concept of joint controllership: the fact that a website provider enables Facebook to collect information coupled with the economic interests of both parties suffice.

Content from our partners
Green for go: Transforming trade in the UK
Manufacturers are switching to personalised customer experience amid fierce competition
How many ends in end-to-end service orchestration?

“This is a very broad interpretation which is likely to seriously impact a large number of website operators and potentially also have implications for business models on the Internet. This impact is all the more important as the level of awareness and understanding of these rules are likely to considerably vary among operators.”

The opinion is likely to leave businesses seriously considering the potential risk of having a Facebook like button embedded: it’s certainly likely to lead to more pop-ups: the ECJ said that website owners need to furnish users of the like button with “their [the website owner’s] “identity and the purposes of the processing”.

Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how New Statesman Media Group may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.