3

GDPR states that a data subject have the right to get a copy of the data about the subject the data controller has collected, and in some cases deletion of said data. If I understand correctly, this also includes data that are collected with an ID set in a cookie, like Facebook Pixel does. Do Facebook Pixel have any way of getting the data of a single user through a userID, and also a function for deleting this data?

I know Google Analytics have a function for deleting the data of a userID, and was wondering if Facebook Pixel had a similar function.

If this doesn't exist, then I can't believe that Facebook Pixel is GDPR compliant.

Improve this question
2
  • Please clarify what you mean by "has the right to get insight in". Under the GDPR a data subject has the right to get a copy of data about the subject held by or on behalf of a data controller.
    – David Siegel
    Commented Feb 10, 2021 at 16:16
  • Yes, by "user has the right to get insight in" I meant the data subject's right to get a copy of the data about the subject the data controller has collected.
    – stiffi
    Commented Feb 11, 2021 at 11:18

1 Answer 1

Reset to default
3

The Facebook Pixel analytics solution does not seem to support access or erasure for data subjects. While there are some GDPR compliance features, these focus on collecting consent prior to collecting data. The relationship between the pixel user and Facebook is also murky. For certain kinds of data, Facebook acts as the data processor only, and the user has all the responsibility as the data controller. For other kinds of data, Facebook and the Pixel user are joint controllers, and therefore jointly responsible.

This lack of features doesn't necessarily mean that Facebook Pixel is in violation of the GDPR, since the GDPR Right to Erasure only applies under certain circumstances. However, it is really difficult to argue that a website or app that integrates Facebook Pixel would be compliant. It is also rather dubious that Facebook could be compliant themselves, since their pixels will also collect data about persons who are not Facebook members.

While these problems are most apparent with the Facebook Pixel since it's explicitly intended for tracking, this problem also applies to any other embeds provided by Facebook, such as like buttons. This was the subject of the Fashion ID case, in which the ECJ determined (in 2019) that the site operator is a joint controller with regards to data collection on the website by the Facebook embed. This effectively means that third party embeds can only be loaded after the website visitor has given consent for sharing data with Facebook.

The tracking of non-users by Facebook was seen as especially problematic in Belgium, where Facebook had been banned from collecting such data already in 2015 (which was upheld in 2018). Since this was pre-GDPR, FB is currently litigating whether Belgium can continue enforcing their ban. I expect that Belgium will prevail with their ban. While this has no immediate consequences for Pixel users, this would make it more likely that Pixel users could be sued or fined successfully.

From an advertiser perspective, Facebook does have valuable data that make the integration of Facebook Pixel an attractive proposition. However, other analytics solutions are much easier to bring into compliance. This is ultimately a business decision: will the better understanding of your ad spend on Facebook outweigh the risk and effort of integrating the Pixel?

Improve this answer
7
  • Thank you for a great answer! What I don't understand is how so many companies are using Pixel without getting penalised. It's common for companies to use Pixel on their websites and they usually state it in their privacy statement (at least in Norway). If the use of Pixel are not GDPR compliant, shouldn't the government be handing out fines to the companies that use Pixel on their website?
    – stiffi
    Commented Feb 11, 2021 at 11:06
  • @stiffi There are two paths for GDPR enforcement. (1) Individual data subjects can sue data controllers for damages and compliance. However, a lawsuit is very expensive. (2) Supervisory authorities can hand out fines but have to perform a thorough investigation first that will hold up when challenged before a court. That takes effort, and most are overworked. It's also difficult to data subjects to learn about these problems, so most of the required lobbying falls to non-profits like NOYB.eu.
    – amon
    Commented Feb 11, 2021 at 12:21
  • 1
    So the companies that are using Pixel are basically gambling that neither individual data subjects or supervisory authorities will try to make a case against them?
    – stiffi
    Commented Feb 11, 2021 at 12:30
  • 1
    @stiffi Everyone is gambling, no one is completely compliant. It's just that FB Pixel users are taking on a bit more risk than Google Analytics users, which are taking on more risk than the weirdos who manually scroll through their Apache log files.
    – amon
    Commented Feb 11, 2021 at 15:05
  • Okey, thank you for all the answers! You have been very helpful :) I've actually considered becoming one of the weirdos that logs the hits in Apache and visualize it through Grafana or something.
    – stiffi
    Commented Feb 11, 2021 at 16:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .