Facebook Like button requires user consent in the EU
Many websites include the Facebook Like button, which transmits data such as the IP address of users. According to a court ruling, website operators in the EU cannot leave the responsibility for this to Facebook alone, but must obtain consent from users.
Internet users are likely to be faced with another consent click when accessing various websites. The European Court of Justice (ECJ) ruled on Monday that website operators are jointly responsible for the collection and transmission of data via the Facebook Like button. However, Facebook alone is responsible for the subsequent processing of the information. In addition to the Facebook "Like" button, other similarly functioning plug-ins, for example from online advertising companies, are likely to be affected by the decision.
The Like button transmits the IP address, the web browser ID and the date and time of the call when the page is loaded, even if the button is not clicked or the user does not have a Facebook account. The consent requirement should also apply to Facebook's "Share" button, for example.
The judges in Luxembourg dealt with the Like button because of a dispute between the North Rhine-Westphalia Consumer Association and the fashion online retailer Fashion ID by Peek & Cloppenburg in 2015. The Consumer Association had argued that the use of the Like button violated data protection law - and filed an injunction against Fashion ID. The Düsseldorf Higher Regional Court then asked the ECJ to interpret several data protection provisions in 2017.
The ECJ argued that the integration of the button allowed Fashion ID to optimize the advertising of its products by making them more visible on Facebook. This was an economic advantage for which Fashion ID had "at least tacitly" consented to the collection of personal data from website visitors.
However, the website is not responsible for the data processing that Facebook carries out after the data has been transmitted. This is because Fashion ID does not decide on the purposes and means of these processes.
In addition, the ECJ confirmed the right of German consumer associations to take legal action in data protection matters at European level, even under the old European directive in force at the time. The General Data Protection Regulation (GDPR), which has been in force since May 2018, already expressly provides for the right of action for associations. (sda)
