The Belgium Privacy Commission has lost its effort to force Facebook to stop tracking non-users of the website when an appeals court ruled it was outside its jurisdiction.
Back in November, the social network was ordered by a Belgian court to kill tracking cookies within 48 hours for people not signed up to – or logged into – its service, or face a daily fine of €250,000.
The court agreed with the commission that by not explaining what it did with the data or asking for consent, the California web giant broke local privacy laws. Anyone that "liked" or shared a Facebook post had a cookie installed on their computer that provided useful information to the company, and hence to advertisers.
Reluctantly, Facebook agreed to end the practice, engaging in some security theatre when it blocked any Belgian users not logged into its network from seeing any public Facebook pages, claiming it was the "only feasible" way to avoid undermining the site's security. It also appealed the decision.
That appeal made a series of arguments in its favor:
- That it has used the cookie for five years and that it helps keep the service "secure" for its 1.5 billion users,
- that it discards the data after 10 days,
- and, bizarrely, that because the Belgian court order used the English words "cookie," "server," "home" and "browser" rather than Dutch equivalents, its decision should be annulled.
However, it was the argument that Facebook's European headquarters is in Ireland that won the day. The appeals court decided that Facebook's practices were not under its jurisdiction, but the Irish authorities'.
"Belgian courts don't have international jurisdiction over Facebook Ireland, where the data concerning Europe is processed," it said in its ruling. It also dismissed the argument that there was an urgent need to make a decision.
The Belgian Privacy Commission is not pleased, but has yet to say whether it will take the case further. Meanwhile, Facebook is delighted: "We are pleased with the court's decision and look forward to bringing all our services back online for people in Belgium," it said in a statement.
By "bringing our services back online" it means, of course, adding tracking cookies back to every one of its millions of webpages. ®