Social media plugins.  Please, take care with any plugins, e.g. YouTube, Vimeo, or Twitter plugins, that you may have on your websites.

Social media has become an essential public-relations and customer-acquisition tool for many companies, especially through the inclusion of tools, such as Facebook’s Like-Button plugin, on a company’s website, which allows the visitor to express their satisfaction with a site on their Facebook profile by clicking on the embedded button.  Companies using such tools should be aware of the data protection implications of the European Court’s decision, Az. C-40/17 from July 29, 2019.

Data protection problems arise because some social media plugins may transfer visitor data to third parties automatically upon loading a page, without requiring any direct action by the visitor.  Facebook’s plugin transmits the visitor’s IP address, the content of the page they visited, as well as, additional browser information to Facebook.  An additional problem is that Facebook also installs cookies on the visitor’s system through their plugin which can create user profiles.

The collection and storage of personal data constitutes a processing of said data and the creation of user profiles is a serious issue in regards to data protection law.  The question before the court was to clarify the liability of companies that used said plugin due to their, at least partial, contribution to the processing of personal data. The European Court had already decided on June 5, 2018, in case Az. C-210/16, that the operators of Facebook fan pages were jointly liable with Facebook.  The latest case has extended that liability to the users of the Like-Button plugin.

The result is that website operators are obligated to at least inform visitors about the collection of personal data and the transmission of said data to Facebook, as well as, obtaining the necessary approval from the visitor before said data can be collected and transmitted.

Although this case dealt with the Facebook Like-Button plugin specifically, the rules it established apply to all social media plugins. Please, take care with any plugins, e.g. YouTube, Vimeo or Twitter plugins, that you may have on your website.

Hagen Albus
Attorney at law at member office Roos Nelskamp Schumacher & Partner in Germany
Data protection officer