My webpage has no analytics because I don't want to show the GDPR consent popup to users. Would I violate GDPR if I integrate the Facebook Chat Plugin without adding the GDPR consent popup?
When integrating third party plugins, it is important to determine whether that third party is your data processor or another controller.
- When they are your processor, you need a legal basis for the processing purpose and need to have a suitable contract with your processor.
- When they are a data controller, you need a legal basis for the processing purposes AND a legal basis for sharing this data with the third party.
When using Facebook tools, you have to read the fine print in their Business Terms. I will assume that when integrating the Chat Plugin, you and Facebook would act as joint controllers. Facebook would not be your data processor.
So you need a legal basis for sending data to Facebook. Some information will already be sent merely by loading the plugin in the visitor's browser – and this will happen whether or not the visitor is a Facebook member.
Two legal bases seem especially interesting: you might have a legitimate interest for loading this plugin, or you might ask for consent.
A legitimate interest requires a balancing test between your interests, and the rights and freedoms of the data subjects. The reasonable expectations of the data subject will likely be a factor as well. Here, I would suggest thinking about the reasonable expectations of a visitor who is not a Facebook member. In most cases, when you rely on a legitimate interest you must also give the opportunity to object to further processing, i.e. to opt-out.
You can base almost any processing activity on consent. This gives you a lot of flexibility at least initially, but you can't use the data for any other purpose, and must make it easy to withdraw consent.
Here, I think that your legitimate interest balancing test would lead you to the conclusion that consent would be the more appropriate legal basis. But this doesn't mean that you need to show a consent banner to every user.
Instead, I would suggest the following procedure before loading any third party plugin or embed (whether a Facebook chat, a Tweet, or a Youtube video). The point is that users are given an informed choice:
- do not load the content by default
- as a placeholder for the content, or in a popup when the user interacts with the placeholder, show the following information:
- what the purpose of this content/plugin/embed is
- that a third party provides the content
- who the third party is
- what personal data will be disclosed to the third party, e.g. IP addresses
- if personal data will be transferred into a non-EU country: information about possible risks, e.g. the US does not provide an adequate level of data protection
- a link to more information in your privacy notice
- how visitors can revoke consent later
- if the visitor clicks a button such as “start chat” or “load content”, treat this as consent
- store the consent for later visits, e.g. in a cookie
- make it easy to withdraw consent, e.g. with an easy to reach button that opens a consent management tool
So instead of asking for consent when your page loads, ask for consent just in time before they're accessing something for which you need consent.
- In the Fashion ID case, the ECJ has found that the provider of a website that loads Facebook social plugins such as the Like Button is a joint controller with Facebook. So the website provider is responsible for collecting and sending personal data to Facebook through this button, but they are not responsible for what Facebook later does with this data.
- At least in Germany, it has long been standard that social plugins are only loaded upon consent, e.g. with a toggle next to the network's logo (news report from 2011).
- The list of information to be shown in a popup was modelled after section 3.3.1 “Minimum content requirements for consent to be ‘informed’” in the EDPB guidelines on consent 05/2020.
- Providing information just-in-time (just before the user takes a relevant action) and in a layered manner (key information directly, details in a privacy notice) are best practices suggested in the WP29 guidelines on transparency which were later endorsed by the EDPB.