Facebook Login (Login with Facebook)

What Facebook Login does and how it appears on a website

Facebook Login is the OAuth 2.0 and OpenID Connect compliant authentication service from Meta. A website embeds the Login with Facebook button by including the Meta JavaScript SDK (sdk.js from connect.facebook.net) or by using the Facebook Login dialog directly. After the user authorises the requested permissions (email, public profile, friends list, age range, marketing preferences), Meta returns an access token that the website can use to retrieve graph data through the Graph API.

In practice, the website operator decides which Facebook permissions to request, whether to store the Facebook user ID in the local database, and how to combine Facebook data with the rest of the profile. Each of these decisions has direct GDPR consequences.

Cookies and data collected by Facebook Login

Facebook Login sets multiple cookies on the .facebook.com third party domain: c_user (the logged in user ID), xs (session), datr (browser identifier, 2 years), sb (browser security), fr (advertising identifier, 90 days) and others. On the operator domain, Meta may store a Facebook Login token in localStorage as fblo_<APP_ID> and a short-lived state parameter for the OAuth handshake. The Graph API call transmits the IP address, the User-Agent, the requested permissions and the application ID to Meta servers.

GDPR and ePrivacy implications

Loading the Meta JavaScript SDK before the user clicks the Login with Facebook button is treated by several EU regulators (CNIL France, Datenschutzbehoerde Austria, AEPD Spain) as a social plugin requiring prior consent under Article 5(3) ePrivacy. The Bundeskartellamt Meta decision, confirmed by the CJEU in case C-252/21 (4 July 2023), held that combining Facebook data with off-platform data requires consent, not legitimate interest. The website operator and Meta act as joint controllers for the data sharing initiated by the login button.

International data transfers

Meta Platforms Inc. (US) is certified under the EU-US Data Privacy Framework. The Meta DPA includes Standard Contractual Clauses for jurisdictions outside the framework. Following the Irish Data Protection Commission decision against Meta of 22 May 2023, Meta has accelerated its EU Data Center build out (Ireland, Denmark, Sweden, Spain) but the identity verification still passes through US infrastructure. A transfer impact assessment is recommended.

Consent and legal basis

Consent (Article 6(1)(a) GDPR) is required for the initial Meta SDK load and for the broader data exchange with Meta. Contractual necessity (Article 6(1)(b)) can cover the strictly authentication related processing once the user has clicked Login with Facebook. Any optional permission (friends list, marketing audiences, custom audiences) needs separate granular consent.

Practical compliance steps

Load the Meta SDK only after explicit consent, configure the Facebook app to request the minimum permissions, store only the Facebook user ID and the data strictly necessary for the account, document the joint controller arrangement using the Meta Joint Controller Addendum, list Meta as a recipient in the privacy notice, provide an alternative login method (email and password or another SSO provider), and offer an easy way to disconnect and delete the Facebook ID from the customer profile.