Facebook is in trouble from the Belgian privacy commission- which is cross that it tracks internet users who are not members of the social network.
A court has ruled that it is unacceptable that every time someone clicks a “like” button on a website, their browsing activity is collected, regardless of whether they are Facebook users or not.
The controversy centres around a cookie – a simple text file which can track a number of user activities – which Facebook has used for the last few years.
Researchers found that even non-members who visited any page that fell under the facebook.com domain would have what Facebook calls its datr cookie – which has a two-year lifespan – installed on their browser.
They conducted a series of tests including one where they did a Google search for the term “facebook data policy”. It led them to the Facebook data policy page which placed the datr cookie on their browser.
They then visited a Belgian website related to prostate cancer treatment which includes a Facebook like button and found that the datr cookie was sent to Facebook.
There was no formal Facebook privacy notice regarding any cookie being stored.
It’s tracking functionality has led the Belgian court to, rather dramatically, give Facebook 48 hours to stop using it or face a fine of £176,000 per day.
Investigators were drawn to the details of how Facebook’s cookies worked when the social network rolled out new terms and conditions in January, authorising it to track its users across websites and devices, use profile pictures for both commercial and non-commercial purposes and collect information about its users’ locations.
Users could agree to the changes or they could leave Facebook.
One of the things that the Belgian privacy commission did in response to the changes was commission a report from the Universities of Leuven and Brussels.
It concluded that tracking non-users was in breach of EU law.
Its findings were handed to the Belgian authorities who, after initial talks with Facebook failed to reach agreement, decided to take the case to court.
The judge agreed with the Belgian privacy commissioner, ruling that the information collected by the social network was personal data “which Facebook can only use if the internet user expressly gives their consent”.
Advertising revenue is Facebook’s biggest source of income, jumping 45% this year, with mobile ad sales accounting for 78% of that. Being able to track web browsing habits, even anonymised ones, allows it to better target that advertising.
Privacy campaigners are very clear though about what they want from Facebook.
They argue that Facebook needs to be more explicit about what it is tracking and offer users the right to opt in to such tracking rather than having to search through the site to find ways to opt out.
And a court in Austria is now considering whether it will bring action against Facebook for violating privacy laws in its country.
The battle between privacy campaigners and the big tech firms is far from finished.