Facebook has been told to stop tracking Belgian citizens' online habits, and to delete all the data it holds on them, or it could be fined up to €100m.
The Brussels Court of First Instance today ruled that Facebook doesn't provide users with enough information on what data it gathers on people's web use or how long that data is retained.
The case, brought by the Belgian Privacy Commission, asked the court to consider the information that Facebook collects about web browsing.
It focuses on the cookies, social plug-ins – such as the "like" or "share" buttons – and invisible pixels that litter the internet, and how Facebook uses them to collect information on their browsing behaviour.
The ruling is the second major case Facebook has lost this week, after a German court ruled the biz hadn't done enough to alert people to the pre-ticked privacy settings on its mobile app.
However, the Belgian judgment comes with a hefty fine that could see the biz paying out more than €100m if it doesn't get its act in line with the country's privacy laws.
According to Belgian site Bruzz, Anouk Devenyns, the press judge at the court, said: "Facebook does not inform us enough about the fact that it collects information about us, about the nature of the information it collects about us, about what it does with that information and about how long it stores that information."
Devenyns added that it "does not get a valid permission to collect and process all that information".
The Zuckerborg has now been told to stop tracking and registering users' browsing habits until it complies with Belgian privacy laws, and that it must delete all the personal data the court deems it has collected illegally.
If it doesn't, the court has said it could be fined €250,000 a day, with a maximum of €100m, according to Bruzz.
Philippe De Backer said on Twitter* that this was a "victory for privacy" and that it was now clear that companies must stop tracking people online.
Wat een overwinning voor de privacy! Stiekem iemand volgen op internet zonder dat je het weet kan duidelijk niet! Belangrijke mijlpaal voor de #privacy in ons land en Europa @CBPL_CPVP https://t.co/hRLUIr6ETH— Philippe De Backer (@debackerphil) February 16, 2018
Facebook, however, said that it was "disappointed" with the verdict and would appeal.
"The cookies and pixels we use are industry-standard technologies and enable hundreds of thousands of businesses to grow their businesses and reach customers across the EU.
"We require any business that uses our technologies to provide clear notice to end-users, and we give people the right to opt-out of having data collected on sites and apps off Facebook being used for ads." ®
* A Flemish-speaking reader has kindly translated the Tweet as follows: "“What a victory for privacy! Secretly following someone on the Internet without their knowledge is clearly not allowed! Important milestone for #privacy in our country and Europe.”