Facebook Chat Plugin

Meta sets several cookies when the plugin loads. The datr cookie (2 years) identifies the browser for security and fraud prevention. The sb cookie (2 years) stores browser details. The wd cookie (session) records screen dimensions. The fr cookie (90 days) is used for advertising targeting and measurement. When the visitor is logged in to Facebook, the c_user and xs session cookies are also present and link all activity to the authenticated account.

Yes. The plugin loads the Facebook SDK which sets advertising and analytics cookies including the fr cookie before any conversation takes place. Under the ePrivacy Directive these cookies require prior consent. You must block the plugin script via your consent management platform until the user opts in to at least the marketing and analytics categories.

The legal basis is consent under Article 6(1)(a) of the GDPR. The website operator and Meta are joint controllers for the data collected when the plugin loads, as confirmed by the CJEU Fashion ID ruling. Both parties must have a valid legal basis. Consent covers the cookie placement and the data transfer to Meta. There is no non-consent basis for the advertising cookies the plugin sets.

Yes. All data collected by the plugin including conversation content, visitor IP addresses and cookie identifiers is processed by Meta Platforms Inc. in the United States. Meta relies on the EU US Data Privacy Framework and standard contractual clauses as the legal transfer mechanism. You should reference these safeguards in your privacy notice and conduct a transfer impact assessment if required by your supervisory authority.

Yes, a DPIA is strongly recommended. The plugin carries a high risk classification because it enables Meta to receive conversation content and cookie identifiers for every page load, not just when visitors use the chat. The combination of advertising cookies, potential account linking and US data transfers meets the threshold for a mandatory DPIA under Article 35 of the GDPR in most supervisory authority guidance.

Block the Facebook SDK snippet until explicit consent is given covering both analytics and marketing. Use a consent management platform to control loading. Update your privacy notice to disclose the joint controller relationship with Meta and the US data transfer. Add all plugin cookies to your cookie policy. Conduct a DPIA. Consider whether a direct Messenger link or an on-site contact form could replace the plugin with less privacy impact.

Yes. On-site contact forms process data entirely on your own server without third party cookie placement. A direct Messenger link using m.me URLs opens Messenger without loading any SDK on your site. Live chat tools such as Crisp, Chatwoot or Tawk.to set fewer advertising cookies and some can be self-hosted. These alternatives reduce or eliminate the joint controller issue and the advertising cookies.

Your cookie policy should list datr (2 years, browser identification and security), sb (2 years, browser details), wd (session, screen size), fr (90 days, advertising and measurement), and note that c_user and xs may be present for logged-in Facebook users. Identify Meta Platforms Inc. as the data controller for these cookies, state the legal basis as consent, and reference the US data transfer safeguards.