Data Protection and Social Media Plugins: What Every Website User Should Know

Data Protection and Social Media: Social media buttons, “like” and “share” features, and embedded content are increasingly common on websites. But do we actually know what kind of personal data these elements collect about us – possibly even without our consent?

The Hungarian National Authority for Data Protection and Freedom of Information (NAIH) has recently issued a new position paper that brings clarity to the issue. Let’s see what this means from a user’s perspective!

Who Processes Our Personal Data via Social Media Plugins?

Most website operators integrate so-called “social media plugins” into their sites, which – often unnoticed – transmit personal data to social media platforms in the background. This includes elements like the Facebook Pixel or a share button.

According to the NAIH, in such cases, the website operator and the social media provider are considered joint data controllers. This means they are both responsible for the data collection, regardless of who actually processes the data in the end.

When Is Consent Required – and When Is It Valid?

In line with the guidelines of the European Data Protection Board (EDPB), the NAIH has made it clear: user consent is mandatory for the use of social media plugins that process personal data.

But how this consent is obtained matters:

Consent is only valid if users are given a genuine choice.
Access to website content must not be made conditional on giving consent.
Users must be allowed to make individual decisions about each cookie and plugin.

For instance, if the website only becomes visible after clicking “Accept Cookies,” this does not qualify as voluntary consent.

What Does This Mean in Practice?

As users, it is important to know that we have the right to:

Refuse marketing or tracking cookies.
Access the website content even without consenting to data processing.
Request a clear, detailed, and transparent privacy policy.

As a website operator, the following steps are essential:

✅ Audit what data is collected and transmitted through the site.
📑 Prepare a privacy notice specifically covering social media plugins.
👤 Implement a valid and effective consent mechanism.
🤝 Review the privacy policies of the social media platforms used.
📘 Comply with the EDPB Guidelines No. 8/2020.

Further Information and Legal Advice

Katona & Partner Attorneys’ Association can help you navigate the complexities of data protection compliance – whether you’re a sole entrepreneur, SME, or large enterprise with a professional web presence.

Dr. Katona Géza, LL.M. ügyvéd (Rechtsanwalt / attorney at law)

___________________________________