EU Court of Justice ruling may spell the death of social like and share buttons
Online websites that embed a Facebook Like button are responsible for the data they send to Facebook and liable for the same penalties under EU data protection laws, the Court of Justice of the European Union (ECJ) said in an opinion published today.
The ruling comes in a years-old lawsuit that began in Germany in 2015, when Verbraucherzentrale NRW, a German consumer group, sought an injunction against Fashion ID, a German fashion retail shop.
NRW claimed that by embedding the Facebook Like button on its website, Fashion ID was allowing Facebook to collect data on the site's visitors without their direct approval.
The German consumer group sued Fashion ID in a German court in 2015, in an attempt to get the site to remove the button, or seek permission from its users.
The case moved through the German legal system, from a local Dusseldorf court to Germany's highest court in Berlin, who, in lack of a clear precedent, sought an official opinion from the ECJ last year, before issuing a final judgment.
That opinion came today, and according to Europe's highest court, any website that uses a Facebook Like button, or a similar social plugin, is responsible for the user data the button collects and sends to a third-party firm.
The ECJ justified its decision by saying that Fashion ID was obtaining a direct commercial benefit from placing Facebook Like buttons on its website.
The ECJ said the presence of the Like buttons and the data collected through them allowed Fashion ID to boost the visibility of its products on Facebook, and gain a direct advantage from the buttons, together with Facebook.
If both parties profit, then both parties share responsibility for the data collection, the ECJ ruled. This means that both companies must obtain permission, have a privacy policy in place, and make sure the data is being stored in accordance with privacy legislation.
Today's decision is also important because the case was judged under the EU's old Data Protection Directive of 1995, the law that was superseded by the EU General Data Protection Regulation (GDPR) that entered into effect in May 2018. Technically, it should also apply under GDPR, considered a stricter legislation.
The ECJ's judgment is not binding in any way. It is only an official opinion on how the Berlin court can judge its case. The Berlin court can -- or not -- use this opinion in its final ruling in the Fashion ID case.
Other courts in other countries can also use the ECJ opinion to judge similar cases.
A ruling against Fashion ID in its Berlin case will greatly impact how European websites deploy social plugins on their sites, and many may think twice about the possibility of sharing a fine with Facebook because of something as useless as "like" buttons, in the case of a data breach involving data collected through the buttons.
Websites that don't have a direct commercial benefit may drop social plugins altogether.
However, Facebook doesn't believe this may happen.
"Website plugins are common and important features of the modern Internet," said Facebook Associate General Counsel Jack Gilbert, when ZDNet reached out for comment earlier today.
"We welcome the clarity that today's decision brings to both websites and providers of plugins and similar tools. We are carefully reviewing the court's decision and will work closely with our partners to ensure they can continue to benefit from our social plugins and other business tools in full compliance with the law."
Article updated on July 29, 11:40am ET, with comment from Facebook.