Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
The Facebook Chat Plugin embeds a Meta Messenger chat widget on your website, allowing visitors to chat with your Facebook page. It loads the Facebook SDK from Meta, sets Meta cookies and may link conversations to the visitor Facebook account.
The Facebook Chat Plugin, also known as the Messenger chat widget, is a product from Meta that embeds a live chat interface directly into a website. When the plugin loads it requests the Facebook SDK from Meta servers, which renders a Messenger bubble in the corner of the page. Visitors can start a conversation that is handled through the website owner's Facebook page, even without a Facebook account, though logged-in users benefit from conversation history.
Meta sets multiple cookies when the plugin loads. The datr cookie (2 years) identifies the browser for security and fraud prevention. The sb cookie (2 years) stores browser details. The wd cookie (session) records the screen dimensions. The fr cookie (90 days) is used for advertising targeting and measurement. When the visitor is logged in to Facebook, the c_user and xs session cookies are also present and link all activity to the authenticated account. The visitor IP address is sent to Meta on every request to connect.facebook.net and related domains.
Loading the Facebook Chat Plugin triggers the placement of Meta cookies and the transfer of personal data to Meta before any conversation takes place. Under the ePrivacy Directive this requires prior consent. Under GDPR, the website operator and Meta are joint controllers for the processing triggered by the plugin, as confirmed by the Court of Justice of the European Union in the Fashion ID ruling. The high risk classification reflects the advertising cookies set, the potential link to a Facebook identity and the US data transfer.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
The Facebook Chat Plugin script must be blocked until the visitor has given explicit consent covering both analytics and marketing, as the fr advertising cookie is set automatically. A consent management platform should load the plugin only after opt in. Because the plugin has no cookieless mode, declining consent means the widget must not be rendered at all. Consider showing an alternative contact method such as an email link when the user has not consented.
All data collected by the plugin is processed by Meta Platforms Inc. in the United States. Meta relies on the EU US Data Privacy Framework and standard contractual clauses as the legal transfer mechanism. Website operators should reference these safeguards in their privacy notices and conduct a transfer impact assessment if required by their supervisory authority.
Obtain explicit consent before loading the plugin. Block the Facebook SDK snippet at the tag manager or server level until consent is granted. Update your privacy notice to disclose the joint controller relationship with Meta and the US data transfer. Add the plugin cookies to your cookie policy. Conduct a DPIA given the high risk classification. Consider whether a direct Messenger link or an on-site contact form could replace the plugin with lower privacy impact.
Websites using Facebook Chat Plugin must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is strongly recommended before deploying the Facebook Chat Plugin given the high risk classification. The plugin enables Meta to receive conversation content, visitor IP addresses and cookie identifiers for every page load, regardless of whether the visitor interacts with the chat. Data is transferred to Meta Platforms in the United States. Assess whether a less privacy-intrusive alternative can fulfil the same business need, and document the necessity and proportionality of the processing.
Sample consent text
We use the Facebook Chat Plugin on this website to allow you to contact us via Messenger. When you enable this feature, Meta Platforms will load scripts and cookies on your device and may link your visit to your Facebook account. Your conversation data and IP address will be sent to Meta in the United States. You can withdraw your consent at any time.
Third-party domains contacted
connect.facebook.netwww.facebook.comgraph.facebook.comfacebook.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| datr | Security | 2 years | Browser identifier set by Meta for security and fraud prevention purposes |
| fr | Marketing | 90 days | Advertising cookie set by Meta used for targeting and measuring ad campaigns across sites |
| sb | Functional | 2 years | Stores browser details such as browser type and settings for Meta services |
| wd | Functional | Session | Records the screen dimensions to optimise the Messenger widget rendering |
Facebook Chat Plugin uses cookies for user preferences — inform visitors with a consent banner.
Meta sets several cookies when the plugin loads. The datr cookie (2 years) identifies the browser for security and fraud prevention. The sb cookie (2 years) stores browser details. The wd cookie (session) records screen dimensions. The fr cookie (90 days) is used for advertising targeting and measurement. When the visitor is logged in to Facebook, the c_user and xs session cookies are also present and link all activity to the authenticated account.
Yes. The plugin loads the Facebook SDK which sets advertising and analytics cookies including the fr cookie before any conversation takes place. Under the ePrivacy Directive these cookies require prior consent. You must block the plugin script via your consent management platform until the user opts in to at least the marketing and analytics categories.
The legal basis is consent under Article 6(1)(a) of the GDPR. The website operator and Meta are joint controllers for the data collected when the plugin loads, as confirmed by the CJEU Fashion ID ruling. Both parties must have a valid legal basis. Consent covers the cookie placement and the data transfer to Meta. There is no non-consent basis for the advertising cookies the plugin sets.
Yes. All data collected by the plugin including conversation content, visitor IP addresses and cookie identifiers is processed by Meta Platforms Inc. in the United States. Meta relies on the EU US Data Privacy Framework and standard contractual clauses as the legal transfer mechanism. You should reference these safeguards in your privacy notice and conduct a transfer impact assessment if required by your supervisory authority.
Yes, a DPIA is strongly recommended. The plugin carries a high risk classification because it enables Meta to receive conversation content and cookie identifiers for every page load, not just when visitors use the chat. The combination of advertising cookies, potential account linking and US data transfers meets the threshold for a mandatory DPIA under Article 35 of the GDPR in most supervisory authority guidance.
Block the Facebook SDK snippet until explicit consent is given covering both analytics and marketing. Use a consent management platform to control loading. Update your privacy notice to disclose the joint controller relationship with Meta and the US data transfer. Add all plugin cookies to your cookie policy. Conduct a DPIA. Consider whether a direct Messenger link or an on-site contact form could replace the plugin with less privacy impact.
Yes. On-site contact forms process data entirely on your own server without third party cookie placement. A direct Messenger link using m.me URLs opens Messenger without loading any SDK on your site. Live chat tools such as Crisp, Chatwoot or Tawk.to set fewer advertising cookies and some can be self-hosted. These alternatives reduce or eliminate the joint controller issue and the advertising cookies.
Your cookie policy should list datr (2 years, browser identification and security), sb (2 years, browser details), wd (session, screen size), fr (90 days, advertising and measurement), and note that c_user and xs may be present for logged-in Facebook users. Identify Meta Platforms Inc. as the data controller for these cookies, state the legal basis as consent, and reference the US data transfer safeguards.