Belgian Court tells Facebook to stop tracking non-members

“People have really gotten comfortable not only sharing more information and different kinds, but more openly and with more people. That social norm is just something that has evolved over time,” said Facebook’s Mark Zuckerberg, in 2010.1The President of the Court of First Instance in Brussels appears to disagree.

Facebook is one of the big players in online marketing, and collects massive amounts of information about people. Facebook has more than 1.4 billion registered users, and in 2014 made over 12 billion Dollars from advertising.2

Most people might understand that Facebook collects information about them when they are on the Facebook website and are logged-in to Facebook. But many people might not realise that Facebook also collects information about them when they visit other websites. Facebook can follow Facebook members’ browsing behaviour on every website that includes a ‘Facebook Like’ button.3

Facebook can even follow the behaviour of non-members on websites that have a Facebook button, if such non-members ever visited a website of the Facebook.com domain. In brief, the first time that somebody visits the Facebook website, i.e. the Facebook page of a shop or a restaurant, Facebook drops a cookie on his or her computer with a unique identifier. Cookies are small text files that website publishers can store on an internet user’s computer. If the cookie contains a unique identifier, website publishers can recognise the visitor’s computer. Cookies that are used to follow people around the web are often called tracking cookies.

Court decision

The summary proceedings against Facebook were initiated by the Belgian Data Protection Authority on the basis of an academic report on Facebook’s policies and terms. Referring to the Google Spain case, the Belgian Court established in its decision on 9 November 2015 that it can decide on the Facebook case, since, in short, Facebook has a subsidiary in Belgium that engages in activities that are inextricably linked to those of Facebook. To initiate summary proceedings a case needs to be ‘urgent’. The Court considers that this criterion is met because the case concerns the alleged violation of the fundamental rights and freedoms of millions of people.

The Court says that Facebook processes personal data by collecting and storing cookies with the above mentioned unique identifiers, and people’s IP addresses. The Court rejects Facebook’s argument that non-members have given their consent for placing the cookie, as required by the e-Privacy Directive. The Court dismisses Facebook’s argument that the cookie is necessary for security purposes. The Court says that Facebook’s use of cookies is disproportionate towards non-members, and insufficient for security purposes. The Court concludes that Facebook does not have a legal basis to process the personal data, cookies with unique identifiers and IP addresses of internet users that do not have a Facebook account.

The Court deems the processing of data and tracking the browsing behaviour of non-members a “manifest” violation of Belgian privacy law. The court suggests that Facebook could easily stop the tracking of Belgian non-users (on the basis of Belgian IP addresses). It ordered Facebook to cease these activities within 48 hours and imposed a penalty of 250.000 € per day in case of non-compliance. The fine is based on the financial capacity of Facebook, but also on the scale of the violations and the possibility that sensitive data are involved. Facebook has already said that it will appeal the ruling. But the judgment of 9 November, including the order of the Court and the penalty threat, will remain in force until the appeal.

After the Facebook judgment

Facebook says it will comply with the order, trying to cause minimal disruption of its services to Belgian users. Tracking of Belgian non-members by Facebook through social media buttons has presumably ended at the time of writing.

The Belgian Data Protection Authority says it will not stop at Facebook in enforcing the laws on cookies and tracking. Although the case dealt with Facebook, the conclusions of the Court would also apply more generally to the tracking of people without their consent. Many websites feature multiple social media buttons in addition to the Facebook button, for instance from Twitter, Instagram, and YouTube. Some social media companies might track people without proper consent too. Many behavioural targeting companies, such as advertising networks, also track people without their consent.

Facebook’s privacy policy is also under review in France, Germany, the Netherlands, and Spain. Although the Belgian case is a national case that does not necessarily affect other jurisdictions, it may influence how Data Protection Authorities and courts in other countries decide on these issues.

For instance, the Belgian Court sees the tracking of non-users as the processing of personal data, even though Facebook does not necessarily know the names of non-users it tracks with its cookies. The Court’s view is in line with the view of the Article 29 Working Party, the advisory body within which the national Data Protection Authorities in Europe collaborate. The Court’s view may influence other cases in which companies that engage in tracking for behavioural targeting purposes claim to process only “anonymous” data, and that therefore data protection law does not apply to them.

But the Belgian Facebook case is a first instance summary-proceedings-case. Whether the Belgian Court of Appeal will be equally vigorous in its rejection of non-member tracking remains to be seen.