Facebook thumbs up over European flag

Consent must be given for tracking via Facebook ‘Like’ buttons, EU court rules

Image credit: Dreamstime

The European Court of Justice (ECJ) has ruled that companies which incorporate the ‘Like’ button on their websites are liable for Facebook tracking and must request user consent to transfer their data to Facebook.

Many companies embed a Facebook ‘Like’ button on their website along with other social media sharing tools. This allows the companies to promote their products across social media.

However, the installation of these buttons across the internet has attracted fierce criticism from civil rights and privacy groups, including the American Civil Liberties Union, due to their frequent use as ‘beacons’ to track browsing activity for the purposes of data collection and ad targeting. This practice has been forbidden by the German Data Protection Commissioner’s Office, and partially banned by the Belgian government.

This legal case was brought to the ECJ by a German consumer group, Verbraucherzentrale NRW, taking action against online fashion retailer Fashion ID. As a consequence of Fashion ID’s Facebook Like button being embedded on the website, visitors have their data (such as IP address) transmitted to Facebook without the visitor’s knowledge and regardless of whether or not they have an account with Facebook, and regardless of whether or not they clicked the Like button.

The Court ruled that Fashion ID can be considered a joint ‘controller’ of data with Facebook, with both companies benefitting from the collection, transmission and processing of data, although Fashion ID is not responsible for how Facebook processes the data it receives.

This means that – under the new EU-wide General Data Protection Regulation (GDPR) – Fashion ID must obtain the consent of visitors for their data to be collected and transmitted to Facebook. This means that visitors site must be made aware that their data will be sent to Facebook if they give consent.

Verbraucherzentrale NRW welcomed the ruling. Its head, Wolfgang Schuldzinksi commented: “Companies that profit from user data must now live up to their responsibility.”

“We are carefully reviewing the court’s decision and will work closely with our partners to ensure they can continue to benefit from our social plugins and other business tools in full compliance with the law,” Facebook’s associate general counsel, Jack Gilbert, said in a statement. Meanwhile, Germany’s tech industry group Bitkom have criticism the ECJ imposing the responsibility of gaining user consent on website operators of all sizes.

Over the past year and a half, Facebook has battled for its reputation following a series of revelations about the extent of its aggressive data collection practices, and the sharing of user data with third parties. The Cambridge Analytica scandal, in which a data analytics company was found to have collected data from 87 million Facebook users through a personality quiz and used this data to create psychologically-targeted political adverts, resulted in Facebook receiving a $5bn fine from the US Federal Trade Commission, and has put regulation of online giants on the political agenda across the globe.

Sign up to the E&T News e-mail to get great stories like this delivered to your inbox every day.

Recent articles