Facebook Loses Belgium Privacy Lawsuit

A district court in Belgium ruled that Facebook is indeed violating EU’s privacy laws with its "shadow tracking" of users across the web. Unless the company changes its behavior, it will have to pay 250,000 euro ($310,000) a day in fines.

Facebook’s Difficult Time In The EU

Two years ago, Facebook emerged as the victor in a lawsuit launched by the Belgium Privacy Commission against the company for violations of EU privacy laws. The Commission accused Facebook of tracking both users and non-users of its platform across the web via the “datr” cookie.

Facebook has for years said that the datr cookie wasn’t meant to track users across the web, and when it got caught twice doing it anyway, the company said it was only a bug and that it would be fixed.

However, in the lawsuit at the time, Facebook argued that it has to use the datr cookie to track everyone for security purposes. Facebook argued that it could use the datr cookie to identify PCs infected by botnets. Earlier, Facebook had also announced that the datr cookie would be used for advertising purposes as well.

Facebook was able to win on technical grounds the first lawsuit, as the court then agreed with Facebook that the Belgium Privacy Commission didn’t have jurisdiction to sue Facebook, because the company had its headquarters in Ireland.

Since then, other European courts ruled that companies that have operations and a headquarters anywhere in Europe can be sued in any of the EU member states, if those countries find the company has been violating EU law. In one of those cases, Facebook also tried to argue that its Terms of Service say that any Facebook user can only sue it in the United States. The courts disagreed and called Facebook’s policy “abusive.”

New Belgium Ruling

A Belgium Court of First Instance said that users doesn’t do enough to teach users how it’s tracking them, for them to be able to give valid consent to that tracking. There is also too much uncertainty about the type of data that Facebook collects and users don’t know for how long the company stores the data.

Unless Facebook brings its privacy policies in line with Belgium and EU privacy law, the company has to stop tracking users surfing from Belgium. It must also destroy all unlawfully collected personal data. Failing that, Facebook will have to pay a fine of 250,000 euro ($310,000) a day until it makes those changes, or until it reaches a maximum of $100 million in fines.

The court also said that Facebook must publish the 84-page ruling on its website, and that the last three pages of the ruling will also go into Belgian newspaper.

Facebook wasn’t too happy with the ruling, and in a statement to Tom's Hardware, the company said that it’s going to appeal:

We are disappointed with today’s verdict and intend to appeal. Over recent years we have worked hard to help people understand how we use cookies to keep Facebook secure and show them relevant content. We’ve built teams of people who focus on the protection of privacy - from engineers to designers - and tools that give people choice and control.

The cookies and pixels we use are industry standard technologies and enable hundreds of thousands of businesses to grow their businesses and reach customers across the EU. We require any business that uses our technologies to provide clear notice to end-users, and we give people the right to opt-out of having data collected on sites and apps off Facebook being used for ads.

We are preparing for the new General Data Protection Regulation with our lead regulator the Irish Data Protection Commissioner. We’ll comply with this new law, just as we’ve complied with existing data protection law in Europe.

Compliance doesn’t seem to mean the same to Facebook and the EU Data Protection Authorities, as well as most of the EU courts, which have already found that Facebook was violating--not complying--with EU privacy laws. Authorities from FranceIreland, Spain, and Germany are also investigating Facebook’s privacy practices.

Belgium Secretary of State for Privacy Philippe De Backer (Open Vld) said:

What a victory for privacy. You can not secretly follow someone on the internet without your knowledge, an important milestone for privacy in our country and Europe.
This thread is closed for comments
    Your comment
  • canadianvice
    While I can appreciate someone wanting to maintain their privacy .... I've always wondered why exactly people on FaceBook of all things expect it? The company is very forward with the fact you're the product.
  • derekullo
    Facebook's service/job is quite literally to invade your privacy, as much as you are willing to say/type, in exchange for ease of communication with others.

    The lawsuit is about Facebook tracking the other sites you go to using the datr cookie so that they can then target you with ads.

    For instance lets say you check Facebook and wish your grandmother happy birthday.
    You then goto walgreens.com and check for some aspirin.

    The datr cookie is able to record that visit and report back to Facebook to send over some aspirin ads.

    I do find privacy lawsuits with Facebook to have quite a bit of irony, but I guess the privacy line has to be drawn somewhere ...

    Having said all that I am able to block 99% of all cookies and ads using a combination of:

    Custom hosts file from winhelp2002.mvps.org/hosts.htm
    Adguard DNS
  • Rock_n_Rolla
    Well if they got FB fined for tracking users and exploiting users web behavior for ad purposes and for other data minning purposes, i assume Google will be the next in the line who will got fined big time as well.

    IMO, no matter how EU fined FB or Google, the fact still remains that even if these two loose their tracking ability to make their ad posting business more profitable, these two will simply use their ad features to throw users different ads eventho its not relevant to the users while using the FB app or chrome.

    --Same <mod edit> in other words... In order to secure user data in FB, the EU must demand total Ad removal from FB app so there's no need or no sense of tracking their users anymore because it would be a waste of time doing it and would get nothing about it.

    But im sure it wont happen bcoz and FB will fight EU to their last breath, with out targeted ads in FB or google, they loose their profitability since they earn from ads thru it.