Companies could find themselves in trouble for data collection from now on for using Facebook Inc.’s Like button on their websites, according to a ruling by the European Union’s top court on Monday.

The ruling from the Luxembourg-based Court of Justice of the European Union stated that any companies with an embedded Like button will be responsible along with Facebook for data collection. They must ask for permission from users to transfer data over to the social media giant.

The ruling comes after a German online fashion retailer called Fashion ID was sued by a consumer for a personal data breach relating to the Like button. The ensuing investigation revealed that a person’s data is automatically transferred to Facebook even if the person hasn’t interacted with the plug-in.

In reality, users are giving information to Facebook via sites with the Like button and are not aware of it. The EU wants to see the end of that, so it could mean that many websites will now have to fix the issue and change how the plug-in function works.

The Fashion ID cases actually began in 2015, which came a long time before the European Union’s General Data Protection Regulation.

Under those rules, a data controller must be specific about personal data and how it is collected and processed. Consent must also be given by users. A data processor is the middleman, usually the third-party website that processes data. In this case, the German retailer was ruled to be a controller as well as a processor.

“The operator of a website that features a Facebook ‘Like’ button can be a controller jointly with Facebook in respect of the collection and transmission to Facebook of the personal data of visitors to its website,” the court said. The judges added that the website was not responsible, though, for what Facebook does with the data.

“We are carefully reviewing the court’s decision and will work closely with our partners to ensure they can continue to benefit from our social plugins and other business tools in full compliance with the law,” Jack Gilbert, Facebook’s associate general counsel, said in response.

Facebook isn’t the only company whose widgets are embedded in websites, so it’s thought the ruling might have far-reaching consequences for a number of companies using social plug-ins.

Image: Ksayer1/Flickr