The Swedish Data Protection Agency (IMY) has reached a decision for the first of 5 Facebook Pixel cases currently on their table. On June 25, 2024, they published their decision, which issued a fine of 15 million Swedish kronor—approx 1.34 million euro.
The website owner decided to “drop it like it’s hot” while being investigated. But should you remove the Facebook Pixel from your website as well?
Let’s break down how they used the Facebook Pixel, why they breached the GDPR by doing so, if there were any mitigating circumstances, and what you should do to ensure that your website stays GDPR-compliant and out of any enforcement authorities’ radar.
How did the website owner use the Facebook Pixel?
The website owner also activated a Facebook Pixel feature called Automatic Events. Also this was done “by mistake”.
The marketing department later asked the legal department for approval to use the specific AAM feature for the Facebook Pixel, which the latter denied. Despite this, someone had turned on the AAM feature.
What does Facebook's AAM feature do?
The AAM (Advanced Automatic Matching) feature enables a website that uses the Facebook Pixel to automatically collect visitors’ data and match them with users on their platforms—Facebook and/or Instagram.
The purpose is to track and profile visitors so that your ads can be more accurate and effective. Facebook may also use this information to improve its own services and ad-targeting capabilities, benefiting other advertisers that use its Pixel and ad platform.
What does Facebook’s AE feature do?
The AE (Automatic Events) feature enables a website that uses the Facebook Pixel to automatically track user interactions, such as button clicks, searches, and menu selections.
The purpose is to analyze user behaviour to make your ads more relevant and effective. As for the AAM feature, Facebook may also use this information to improve its services and ad-targeting capabilities.
What happened when the website owner activated the Facebook Pixel?
When the website owner, in this case unknowingly, activated the AAM and AE features, they ended up sharing personal information with Facebook en masse.
Approximately personal data from 500 001 – 1 million individuals between 2019 to 2021. Through the AAM feature, personal information of the following sort was transferred to Facebook.
- Social security number
- Employer,
- Type of employment,
- Bank account number
- Bank loan (amount)
- Contact information such as;
– Phone number,
– Email,
– Postal code
Through the AE feature, personal information of the following sort was transferred to Facebook:
- What bonds you have and their value
- Bank loan amount
- Account number and credit limit
- Fees, taxes and interest rates
- Current orders
- Company owner and bank from which pension was moved
- Social security number
Did every website visitor risk getting their personal information transferred to Meta?
No, “only” those who had consented to marketing cookies on the site and had logged into the site got their movement tracked by the Facebook Pixel and their personal data shipped to Meta.
Some buttons for certain forms on the website were bare for all visitors, targeting visitors who were not customers of the company. Visitors who filled in those fields and pushed those buttons would also get their data transferred to Meta, specifically due to the AE feature of the Facebook Pixel being activated.
Why was the website owner fined for using the Facebook Pixel?
So what was this case about, then?
The DPA did consider whether there were legal grounds, such as consent, for collecting the data. They do, for example, write that only (mostly) visitors who had consented (on a cookie banner, one must presume) to marketing cookies (and then logged into the website as a customer) had gotten their data collected and shared with Facebook/Meta without scrutiny. But the decision from the DPA focused only on how personal data was collected and shared.
What did the website owner get fined for?
Simply put, the website owner transferred sensitive personal data to Meta/Faceboook without proper security measures. They also failed to prevent it and find out about it because they did not have security measures in place that actually worked. Marketing had decided to activate the Pixel, even though they were not allowed, speaks to this, for example.
Were there any mitigating circumstances?
- removed the Pixel swiftly when they found out about it,
- ensured that Meta deleted the data,
- and established a better process to ensure that no one can install scripts on the site or use tools that put their clients and visitors at risk.
However, the Swedish DPA did lower the fine to approximately 1.34 million euros from 20 million euros, which the DPA states is what it could have chosen to impose. The reasoning behind this is unclear.
Do you have the Facebook Pixel on your website?
If you transfer data to services like Facebook by allowing those services on your site or app, you must ensure you have legal grounds for both collecting and processing that data. These are two different but overlapping requirements.
- What scripts have I allowed on my website, and what are they doing?
- Do I need all those scripts and services, or can I remove some?
- Do I collect consent in accordance with the ePrivacy Directive and the GDPR for allowing these scripts to set cookies and collect data from my visitors/users?
If you are unsure about the state of your website and need help determining if the Facebook Pixel is present, here’s what to do:
- Sign up for a free certified Consent Management Platform (CMP) like Cookie Information. It is free for 14 days with no strings attached.
- Install the CMP and let it crawl your entire domain.
- Review the crawl results to see which scripts are present and what cookies they set.
- Remove the services/scripts you do not need or want.
- Ensures you collect consent in an informed and transparent manner in accordance with the ePrivacy Directive and the GDPR.
- Respect user choices by blocking scripts the user denies.
- Makes it easy for visitors to revoke their consent.
- Automatically and continuously scan your site to detect new cookies or pixels set by services.
- Provides a dynamic Cookie Policy that lists all your cookie- and pixel-placing scripts, detailing their duration and linking to each privacy policy.
- Stores consent choices for five years, so you can handle an audit request.
However, you should always talk to your Data Protection Officer (DPO) or consult a tech lawyer if you—for example—have concerns and are unsure of how a service like Facebook handles your visitors’ data and if your business is taking an unacceptable risk by allowing it to.
So is the Facebook Pixel GDPR-compliant, then?
The DPA has only investigated what the data controller is responsible for, as DPAs typically prioritize the actions of data controllers. Investigating the data processor, Meta, would require a separate case. Preferably by the DPA on Ireland, where Meta has its European head quarter.
