EU Court Rules Adding Facebook 'Like' Button Triggers GDPR Data Collection Obligation

Websites with embedded Facebook “like” buttons must inform users their data will be collected and processed by the social media giant, the Court of Justice of the European Union ruled on July 29.

Many sites — including German online clothing retailer Fashion ID, the focus of the ruling — use Facebook's embedded “like” button as a tool to promote their business, allowing users to easily share site reviews or items for sale on social media.

But the button also sends users' personal data to Facebook “without that visitor being aware of it,” the court said. Data was allegedly collected and transmitted from site users who did not use Facebook or click the “like” button.

The court said Fashion ID and other sites “can be considered to be a controller jointly with Facebook Ireland” over the initial data collected from users on their site sent to Facebook because both parties determine “jointly the means and purposes” of that data collection.

Data controllers violating the EU's General Data Protection Regulation could face fines up to 20 million euros or 4% of annual global turnover, “whichever is greater.” Sites are not liable for what Facebook does with the data after it is consensually collected from their users.

To comply with GDPR, sites with a “like” button embed must now provide “at the time of [users' personal data] collection, certain information to those visitors such as, for example, its identity and the purposes of the processing.”

The processing and transmission of personal data through Facebook embeds “can be considered lawful” if sites prove legitimate interest or obtain user consent, which under GDPR must be “freely given, specific, informed and unambiguous.”

Sites that don't feature Facebook's “like” button could still be impacted by the decision, which may apply to plugins leading to other social media sites, such as Twitter or Pinterest.

But of all the U.S.-based social media platforms, Facebook's business has drawn the most ire from European regulators. The company is currently under investigation from the Irish Data Protection Commission over potential GDPR violations and faces an antitrust probe from the European Commission.

In a statement, Facebook associate general counsel Jack Gilbert said website plugins, such as the “like” button, are “common and important features of the modern Internet.”

“We welcome the clarity that today's decision brings to both websites and providers of plugins and similar tools,” Gilbert said. “We are carefully reviewing the court's decision and will work closely with our partners to ensure they can continue to benefit from our social plugins and other business tools in full compliance with the law.”

Fashion ID did not immediately respond to request for comment.

*****

Caroline Spiezio covers the intersection of tech and law for Corporate Counsel, an ALM sibling of Cybersecurity Law & Strategy. She's based in San Francisco. Find her on Twitter @CarolineSpiezio.