The Court of Justice of the European Union (CJEU) has held that
a website operator is considered a joint controller when it embeds
a Facebook 'Like' button on its website but it is not
responsible for any subsequent processing of personal data by
Facebook.
In its judgment, the CJEU provided clarity on the scope of joint
processing operations, and the extent to which a website operator
can be deemed a joint controller, and thus jointly liable, for
allowing the placement of plug-ins and tracking devices on their
website by third parties.
The case (C-40/17) involved a challenge by a consumer protection
group in Germany to the placement of Facebook plug-ins on Fashion
ID's website. This was claimed to be an unlawful means of
collecting and transmitting personal data to Facebook, as neither
Fashion ID nor Facebook had sought or obtained the consent of
visitors to the website, or informed them that this data collection
was taking place automatically. The collection and
