EU's top court rules that sites with embedded Facebook Like buttons are responsible for data collected, must obtain user consent before data is sent to Facebook
suggesting the CJEU ruling will apply to other social platforms"yep https://techcrunch.com/... Sally Hubbard / @sally_hubbard : I hope the EU court ruling is the beginning of the end of this fraudulent global surveillance through FB like buttons: “most Internet users are likely unaware that the social plug-ins are used by Facebook to track what other websites they're visiting...” https://twitter.com/... Jason Kint / @jason_kint : Boom, this is a big deal. The only proper outcome is for Facebook to stop mining user browsing data through its Like buttons across the web which surveil us even when not clicked. We wrote on WSJ about this aggressive Facebook change in 2014. @riptari /1 https://techcrunch.com/... Glenn Gabe / @glenngabe : Sites will need to rework how the FB plugin functions to ensure no data is sent prior to consent -> EU's top court rules that sites with embedded Facebook Like buttons are responsible for data collected, must obtain user consent before data is sent to FB https://techcrunch.com/... https://twitter.com/... Matt Navarra / @mattnavarra : “...Companies that embed Facebook's “Like” button on their websites must seek users' consent to transfer their personal data to the U.S. social network...” https://www.reuters.com/...
Context & Ripple Effects
The CJEU has been walking liability up the stack for two years: first it made Facebook fan-page administrators jointly responsible with the platform for user data, and today's ruling extends that logic to any site that embeds a Like button. Website operators are no longer passive hosts of a widget — they are on the hook for what leaves their pages.
It lands mid-streak for Facebook specifically: within months the same court ruled that pre-checked boxes don't count as consent for tracking cookies (active consent required), then struck down Privacy Shield, and later blocked Facebook from routing EU-wide privacy orders through its Irish regulator alone. Each ruling tightens a different layer of the same compliance web.
First-order effects
- European publishers running Like or Share buttons must now obtain explicit user consent before any browsing data reaches Facebook — or pull the plugins entirely, since most were installed precisely because they cost nothing to maintain.
- Facebook loses its quiet default feed of off-Facebook browsing signals across EU sites; the surveillance value Jason Kint and Sally Hubbard flagged is only recoverable where sites do the consent work on its behalf.
Second-order effects
- Every other social platform with embedded buttons or share widgets inherits the same exposure — TechCrunch notes the reasoning applies beyond Facebook — so plugin ecosystems either grow explicit opt-in flows or shrink.
- Consent-management vendors gain leverage: the ruling stacks on top of the cookie decision, meaning publishers need one consent architecture covering both their own trackers and third-party widgets.
Third-order effects
- Joint-controller liability becomes the default template for the open web: anyone who installs third-party code shares legal responsibility for the data it harvests, shifting economics toward fewer, more heavily consented embeds.
- For Facebook, the pattern compounds — no cross-border escape hatch, no transatlantic transfer mechanism, and shrinking passive collection — pointing toward an EU operation rebuilt on explicit, per-purpose consent rather than ambient tracking.
The trend: The CJEU is systematically converting embedded third-party code from invisible plumbing into shared legal responsibility, closing off passive data collection one integration at a time.