> How Facebook Like, Share and Page plugins create joint controllership under the GDPR, which Meta cookies they set and how to embed them with consent. > > Canonical: https://www.flowconsent.com/en/services/social-media/facebook-social-plugins Social media # Facebook Social Plugins Marketing Facebook Social Plugins are embeddable widgets from Meta (Like and Share buttons, comment box, Page plugin, embedded posts) that load iframes from connect.facebook.net and link the visitor with their Meta identity. [Block Facebook Social Plugins until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=social) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Social media](https://www.flowconsent.com/en/services/social-media) - Consent Marketing - Prior consent Required - Documented cookies 6 - Third-party domains 5 - Servers United States (primary Meta data centres) with global edge points of presence and replication to data centres in Ireland and Denmark for European users. Overview ## What does Facebook Social Plugins do? Facebook Social Plugins are embeddable widgets distributed by Meta Platforms Ireland Ltd that allow third party websites to surface Like, Share, Comment, Page and Embedded Post features. They load through the JavaScript SDK served from connect.facebook.net and render an iframe on facebook.com, which means the browser establishes a direct connection with Meta as soon as the plugin appears. ## **What the social plugins do** Like buttons increment a counter and post to the visitor timeline, Share buttons open a dialog to compose a Facebook post, the Page plugin embeds a preview of a public Facebook Page, the Comments box stores reactions inside Meta and the Embedded Post widget displays a public post. All of them rely on the same SDK and forward referer, IP and cookies to Meta. ## **Data and cookies collected** Meta sets the third party cookies datr, sb, fr, c\_user (when the visitor is logged in to Facebook) and \_fbp on the facebook.com domain when the plugin loads. It also collects the page URL, referer, user agent, IP address, viewport size and mouse movements. The data is combined with the Meta profile if the visitor has an account, even when they are logged out, through the datr cookie. ## **GDPR and ePrivacy implications** The Court of Justice of the European Union confirmed in Fashion ID v Verbraucherzentrale NRW (C-40/17) that the website operator is joint controller with Meta for the data collection and transmission performed by social plugins. Prior, granular consent is therefore mandatory under Article 6(1)(a) GDPR and Article 5(3) ePrivacy. Several supervisory authorities (CNIL, BfDI, AP) have explicitly sanctioned websites that loaded the plugins by default. ## **Data transfers** Meta Platforms Ireland Ltd is the EEA controller, but the data is forwarded to Meta Platforms Inc. in the United States. The transfer relies on the EU US Data Privacy Framework decision of 10 July 2023 (Meta is certified) and, as a fallback, on Standard Contractual Clauses combined with supplementary measures. A Transfer Impact Assessment is recommended in regulated sectors. ## **Practical compliance steps** Sign the Meta Controller Addendum (joint controller agreement) in the Meta Business Manager, gate connect.facebook.net behind your CMP so the SDK only loads after consent, prefer a two click solution (static image that becomes active after a click) or a server side proxy, document the joint controllership in your privacy notice with a link to the Meta information for joint controller, and add Meta to the cookie register with the categories and recipients. Compliance ## Facebook Social Plugins and the GDPR Facebook Social Plugins is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Prior, opt in consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy Directive. The CJEU Fashion ID case (C-40/17) established that the website operator is joint controller with Meta for the collection and transmission triggered by social plugins. - Risk level high - Applicable regulations GDPR, ePrivacy Directive, TTDSG (Germany), LIL (France), Digital Services Act, EDPB Guidelines 8/2020 on targeting of social media users ### Impact assessment (DPIA) Because the CJEU Fashion ID ruling (C-40/17) qualifies the website operator as joint controller with Meta for the data collected by social plugins, a DPIA is recommended whenever plugins are loaded on the home page, on pages with sensitive content (health, politics, religion) or on pages accessed by minors. The DPIA must document the joint controller agreement that Meta provides (Controller Addendum), the categories of data sent (IP, cookies, browser, referrer, mouse movements), the US transfer leg under the EU US Data Privacy Framework and the alternatives considered (static images, two click solutions). ### Sample text for your banner > This page contains Facebook plugins (Like, Share, Page widget, Comments) provided by Meta Platforms Ireland Ltd. If you accept, Meta receives information about your visit, your IP address, your Meta cookies and the page you are viewing, and may combine it with your account profile, including outside the European Union. By clicking Accept, you consent to this transfer; you can refuse and the plugins will not load. Cookies and trackers ## What Facebook Social Plugins sets and contacts - Tracking method Third party iframes and JavaScript SDK served from connect.facebook.net that load Like, Share, Comments, Page and Embedded Post widgets and combine the visit with the user Meta cookies (datr, c\_user, sb). - Server location United States (primary Meta data centres) with global edge points of presence and replication to data centres in Ireland and Denmark for European users. - Data transferred outside the EU Meta Platforms Ireland Ltd is the EEA controller; Meta Platforms Inc. (US) is the original recipient and joint controller. Transfers to the United States rely on the EU US Data Privacy Framework decision of 10 July 2023 and on Standard Contractual Clauses with supplementary measures. ### Cookies set (6) | Name | Type | Duration | Purpose | | ------- | ------------ | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | datr | http\_cookie | 2 years | Third party cookie set by Meta on facebook.com to identify the browser, used for security purposes and to link interactions with social plugins to the user Meta profile. | | sb | http\_cookie | 2 years | Third party cookie set by Meta to identify the browser for security purposes and to facilitate account recovery when accessed from a known device. | | fr | http\_cookie | 90 days | Marketing cookie set by Meta to deliver and measure advertising, including content shown on websites that embed Facebook social plugins. | | c\_user | http\_cookie | Session or 30 days | Authentication cookie set by Meta on facebook.com when the visitor is logged in, used to identify the Facebook user to whom social interactions are attributed. | | \_fbp | http\_cookie | 90 days | First party cookie injected by the Meta Pixel companion of the SDK to identify the browser for ad measurement and conversion tracking. | | xs | http\_cookie | Session or 30 days | Authentication session cookie set by Meta to maintain the secure login state of a Facebook user across pages embedding social plugins. | ### Third-party domains contacted (5) - `connect.facebook.net` - `www.facebook.com` - `facebook.com` - `staticxx.facebook.com` - `static.xx.fbcdn.net` Questions ## Frequently asked questions about Facebook Social Plugins Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does a Facebook plugin set? When the SDK from connect.facebook.net loads, Meta sets several third party cookies on facebook.com, including datr (browser identifier, 2 years), sb (security browser, 2 years), fr (advertising preferences, 90 days), c\_user (logged in user id) and \_fbp (browser identifier for ad measurement, 90 days). These cookies are linked to the visitor Meta account when one exists. ### Do users have to consent to Facebook plugins? Yes. The CJEU ruling Fashion ID (C-40/17) and the EDPB Guidelines 8/2020 require prior, explicit and granular consent before loading any Facebook social plugin, because the plugin sets non essential cookies, transmits personal data to Meta and makes the website operator joint controller with Meta for that collection. ### What is the legal basis for using Facebook plugins? Consent under Article 6(1)(a) GDPR combined with Article 5(3) ePrivacy is the only viable basis. Legitimate interest is not appropriate because social plugins combine cross site identifiers and forward personal data to a US advertising platform, which the EDPB Guidelines 8/2020 explicitly exclude from the legitimate interest pathway. ### Do Facebook plugins transfer data to the United States? Yes. Meta Platforms Ireland Ltd is the EEA controller, but the data is forwarded to Meta Platforms Inc. in the United States. The transfer relies on the EU US Data Privacy Framework decision of 10 July 2023 (Meta is certified) and on Standard Contractual Clauses with supplementary measures. ### Is a DPIA needed for Facebook plugins? A DPIA is strongly recommended when the plugins appear on the home page, on pages dealing with sensitive content (health, politics, religion) or on pages accessed by minors. The DPIA must analyse the joint controllership under the Meta Controller Addendum, the categories of data sent (IP, cookies, browser, referer, mouse movements) and the alternatives considered (static image, two click solution). ### How do I implement Facebook plugins compliantly? Sign the Meta Controller Addendum from the Business Manager, gate connect.facebook.net behind your CMP so the SDK only loads after marketing consent, prefer a two click solution where the plugin is replaced by a static image until clicked, integrate Google Consent Mode v2 with ad\_storage and ad\_user\_data denied by default, and document Meta in the cookie policy and the privacy notice with its joint controller status. ### What are the alternatives to Facebook plugins? Privacy preserving alternatives include static share links that open facebook.com in a new tab without loading the SDK, the Shariff library from Heise (which avoids any contact with Meta until the user clicks), the use of native open share intents on mobile, or migrating the social proof to first party testimonials and reviews hosted on your own domain. ### How do I keep my cookie policy up to date with Facebook plugins? Re scan the affected pages with your CMP whenever Meta updates the SDK because new cookies (or renamed cookies) can be introduced silently. Subscribe to the Meta developer change log and the EDPB news to capture regulatory changes. Update the cookie register and the privacy notice when a new plugin (such as Page or Group plugin) is added to the site. Same category ## More services: Social media [See the whole category](https://www.flowconsent.com/en/services/social-media) ### [Disqus](https://www.flowconsent.com/en/services/social-media/disqus) [Disqus is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Disqus integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Disqus helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/social-media/disqus) [Marketing](https://www.flowconsent.com/en/services/social-media/disqus) · ### [AddShoppers](https://www.flowconsent.com/en/services/social-media/addshoppers) [AddShoppers is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. AddShoppers enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, AddShoppers empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/social-media/addshoppers) [Marketing](https://www.flowconsent.com/en/services/social-media/addshoppers) · ### [Taggbox](https://www.flowconsent.com/en/services/social-media/taggbox) [Taggbox is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Taggbox supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Taggbox ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/social-media/taggbox) [Marketing](https://www.flowconsent.com/en/services/social-media/taggbox) · ### [Isso](https://www.flowconsent.com/en/services/social-media/isso) [Isso is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Isso supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Isso ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/social-media/isso) [Marketing](https://www.flowconsent.com/en/services/social-media/isso) · ### [Commento](https://www.flowconsent.com/en/services/social-media/commento) [Commento is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Commento integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Commento helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/social-media/commento) [Preferences](https://www.flowconsent.com/en/services/social-media/commento) · ### [OnePress Social Locker](https://www.flowconsent.com/en/services/social-media/onepress-social-locker) [OnePress Social Locker is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. OnePress Social Locker supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, OnePress Social Locker remains a leading web.](https://www.flowconsent.com/en/services/social-media/onepress-social-locker) [Marketing](https://www.flowconsent.com/en/services/social-media/onepress-social-locker) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)