Court of Justice of the European Union (EuGH): Responsibility of website operators for Facebook Like button

What must website operators take into account when third-party plugins or tools are integrated? The Court of Justice of the European Union has further developed its case law with a decision on the Like button.

The German company Fashion ID had integrated the Like button from Facebook on its website. Visitors to the site were to be able to quickly and easily like the page or individual content.

The active Like button transmitted data from all visitors of a website to Facebook – including data from visitors who are not members of Facebook. Whether the Like button was clicked is irrelevant.

The Consumer Centre North Rhine-Westphalia (Verbraucherzentrale NRW) saw a breach of the data protection law: Fashion ID transmitted personal data of the visitors of its website to Facebook without their consent and in violation of the information obligations under the provisions on the protection of personal data. The Consumer Centre sued against this and won before the Regional Court (LG) Düsseldorf. Fashion ID appealed. The competent Higher Regional Court (OLG) Düsseldorf referred the fundamental questions in the legal dispute to the Court of Justice of the European Union (EuGH).

Like button only with consent

According to the judgment of the Court of Justice of the European Union (EuGH), operators of a website must inform about the use of an active Like button. Visitors to a website must give their consent in order to comply with the requirements of the so-called Cookie Directive. From a data protection law perspective, there must be a sufficient legal basis for the processing of the personal data collected.
Should the operator rely on its legitimate interest, the data processing must be necessary. The fundamental rights and fundamental freedoms of the person concerned – namely the visitor – must not outweigh it.

This information obligation and consent applies only to the processing of personal data for which the operator actually decides on the purposes and means. Operators of websites would have to obtain consent in order to activate the Like buttons and transmit the data to Facebook. For the further processing of the data, Facebook alone would be responsible.

The Court of Justice of the European Union (EuGH) has thus more clearly delineated the responsibility between the operator of a website and a third-party provider such as Facebook. The use of two-click solutions should have become legally more secure, as it is now clearer to what extent consent must be obtained.

The decision was made on the 'old' law before the GDPR came into force. However, the principles of the decision can be transferred to the current legal situation. The Court of Justice of the European Union (EuGH) continues to follow the line it set with the decision on Facebook Fan Pages: Both the operator of the website and Facebook are jointly responsible for the use of the Like button. Analogous to Facebook Fan Pages, it would also be necessary for the use of the Like button to conclude an agreement on joint responsibility for data processing.

Conclusion

With this judgment, the Court of Justice of the European Union (EuGH) creates considerable legal need for action for operators of online services. The concept of joint responsibility under the GDPR has been defined broadly. Not only with Facebook but also with other providers of internet tools, agreements may be required on the joint responsibility of the two parties responsible for processing user data.

On the positive side, the Court of Justice of the European Union (EuGH) has very clearly confirmed the possibility of effectively delineating responsibilities through user consent and by fulfilling information obligations via appropriate agreements with third-party providers. Legal certainty for operators of online services can thus be significantly improved.