Overview
Meta's JavaScript SDK for embedding social plugins (Like buttons, Share buttons, Login, Comments, embedded posts) on third-party websites. Distinct from the Meta Pixel - this SDK provides social interaction features rather than conversion tracking. The CJEU Fashion ID ruling (C-40/17) established that website operators embedding Facebook Social Plugins are joint controllers with Meta for the collection and transmission of personal data triggered by the plugin.
Detection Capabilities
- Signature count
- 2
- Detection methods
- network
Performance Impact
Performance Impact
- Script size
- 180 KB
- Requests per page
- 2
Common Mistakes
- 1 Loading the SDK without consent - the CJEU Fashion ID ruling (C-40/17) established that website operators are joint controllers with Facebook for the data collection triggered by embedding Social Plugins
- 2 Using XFBML parsing on page load without gating behind consent - the SDK automatically sends user data to Meta when it initialises
- 3 Not disclosing the joint controllership obligation in your privacy notice as required by Fashion ID (C-40/17)
- 4 Embedding Like or Share buttons on pages with sensitive content (health, financial) without a DPIA
Compliance Considerations
Loads scripts from connect.facebook.net and renders social plugin iframes from www.facebook.com. When initialised, the SDK transmits visitor data (IP address, browser metadata, page URL) to Meta regardless of whether the visitor interacts with the plugin.
Consent: Explicit consent required under ePrivacy Art 5(3). The CJEU Fashion ID ruling (C-40/17, 29 July 2019) confirmed that the website operator must obtain consent for the initial data collection, even though Meta determines the purposes of subsequent processing.
Joint controllership: Fashion ID establishes that the site operator and Meta are joint controllers for the collection and transmission phases. A joint controller agreement under GDPR Art 26 is required. Meta's standard terms may satisfy this, but verify coverage.
International transfers: Meta Platforms is certified under the EU-US Data Privacy Framework. Meta operates EU data centres (Dublin, Lulea) - verify data residency commitments in Meta's DPA.
CMP configuration: Categorise under functional or social consent and block SDK initialisation until explicit consent is granted.
Related Services
Google Maps Embed
Med Google
Google Maps embeds loaded via iframe or JavaScript API on third-party websites. The embed transmits the visitor's IP address and browser information to Google's infrastructure on page load. While Maps embeds do not typically set tracking cookies, the IP transmission constitutes personal data processing under GDPR.
3 detection signatures
LinkedIn Social Plugins
High LinkedIn (Microsoft)
LinkedIn's JavaScript SDK for embedding social plugins (Share buttons, Follow buttons, profile badges) on third-party websites. Distinct from the LinkedIn Insight Tag - this SDK provides social interaction features rather than advertising conversion tracking. The CJEU Fashion ID ruling (C-40/17), while decided on Facebook Social Plugins, establishes the principle that website operators embedding any social plugin are joint controllers with the social network for the data collection triggered by the plugin.
2 detection signatures
Twitter/X Embed
Med X (Twitter)
Twitter/X embed widgets loaded via JavaScript on third-party websites. The widgets.js script from platform.twitter.com (or platform.x.com) loads embedded tweets, timelines, and share buttons. On load, the embed transmits visitor data to X Corp's infrastructure including IP address, browser fingerprint, and referrer information.
3 detection signatures
YouTube Embed
High Google
YouTube video embeds loaded via iframe on third-party websites. Standard embeds (youtube.com/embed/) set cookies and transmit data to Google's infrastructure on page load. The privacy-enhanced mode (youtube-nocookie.com/embed/) is widely misunderstood - despite the name, it still sets cookies when the user plays the video, and in some configurations sets cookies on page load. Multiple European DPAs have confirmed that YouTube embeds require consent under the ePrivacy Directive.
2 detection signatures
Need help governing Meta Social SDK?
Our governance diagnostic identifies compliance gaps across your entire tag estate.
Start your Governance Diagnostic