EU's top court rules that sites with embedded Facebook Like buttons are responsible for data collected, must obtain user consent before data is sent to Facebook
Europe's top court has made a ruling that could affect scores of websites that embed the Facebook ‘Like’ button and receive visitors from the region.
Context & Ripple Effects
The court had already established in its fan page ruling last year that anyone operating a Facebook presence is a joint controller alongside Facebook itself. Today's decision extends that logic one layer out: merely embedding the Like button makes a website a data controller too, liable for what flows to Facebook when an EU visitor lands.
That matters because the Like button was effectively invisible plumbing — millions of European sites shipped visitor data to Facebook without any disclosure. The ruling arrives mid-arc: months later the court would tighten the screw further by requiring active consent for non-essential tracking cookies, killing pre-checked boxes.
First-order effects
- Site operators across Europe who embed the Like button must now obtain explicit user consent before any data reaches Facebook — every EU-facing publisher with the plugin is affected immediately.
- Facebook's passive tracking channel through third-party sites is cut off wherever operators comply, since the default embed now transmits data illegally.
Second-order effects
- Publishers face a choice between ripping out the Like button entirely and adding consent prompts before it loads — a compliance cost that pushes smaller sites toward removal and benefits whoever sells consent-management tooling.
- Facebook loses a broad, frictionless source of browsing data outside walled-garden properties, raising the value of the data it still collects directly on its own surfaces.
Third-order effects
- The court is building a doctrine where responsibility follows the data flow rather than the platform boundary — the same reasoning that later led it to strike down Privacy Shield in the transfer-mechanism ruling and to rule Facebook cannot escape EU-wide orders from national regulators in the enforcement decision, leaving embedded-plugin liability as one strand of a systematic tightening around Facebook in Europe.
The trend: European courts are progressively assigning joint-controller liability to every participant in the ad-tracking chain, forcing platforms like Facebook and the sites that embed their tools to gate data flows behind explicit consent.