• Badge: ⚠️ Caution
• Red Flags:
  • RF1 — Own advertising / cross-service profiling
  • RF2 — High-risk third-country exposure without meaningful mitigation
• Risk Indicators:
  • Own-purpose data use (advertising); intrusive tracking; high-risk international transfers

Key Facts: Facebook Like/Share/Comment widgets load Meta scripts that set tracking cookies and transmit visitor data to Meta US servers even if the visitor does not click. This enables cross-site behavioural tracking for Meta's advertising profiling. Austrian DPA found Facebook Login (a Social Plugin) violated GDPR due to US transfer. Irish DPC EDPB binding decisions (Dec 2022) confirmed advertising data processing without valid legal basis.

Framework Note (v2.2): FRAMEWORK NOTE (v2.2): RF2 (high-risk third-country exposure) is recorded here as a significant risk factor and lowers the domain E score. Under the revised framework, RF2 alone does not trigger Caution — the Caution badge for this service is driven by RF1 / RF3 / RF4 (as noted above). The US transfer risk (where applicable) is covered by DPF participation and/or SCCs, which GDPR treats as a compliant transfer mechanism.

Quellen:

• Meta Business Tools Terms (facebook.com/legal/terms/businesstools)
• Meta Privacy Policy
• Austrian DPA findings (2022)
• EDPB binding decisions on Meta (Dec 2022, edpb.europa.eu).

• Unlock additional website features
• Receive personalised marketing offers
• Customise online ads (non-TCF)

• TPP Notified?: Not yet notified
• Decision Contested?: [nicht dokumentiert]