ECJ Rules Companies Using Social Plugins Are Joint Controllers

In Short

The Situation: Fashion ID, a German online clothing retailer, embedded on its website the Facebook "Like" button. When a user consults the website of Fashion ID, that user's personal data are transmitted to Facebook Ireland. The transmission occurs regardless of whether the user is a Facebook member or has clicked on the "Like" button.

The Result: On July 29, 2019, the European Court of Justice ("ECJ") ruled (Case C 40/17), following the Opinion of the Advocate General Bobek of December 2018, that Fashion ID and Facebook Ireland are joint controllers with regard to the operations involving the collection and disclosure by transmission to Facebook Ireland. However, Facebook Ireland is the sole controller regarding its processing after such transmission.

Looking Ahead: Besides updating their privacy policies, website operators that use social plugins, such as the Facebook "Like" button, will be required to ensure a legal basis for processing (this will regularly require obtaining consent from users, for example, via a cookie...