Facebook Like Button

Overview

The Facebook Like Button is one of Meta's social plugins — a small interactive widget that allows visitors to "like" a web page and share it to their Facebook feed without leaving the site. Despite its simple appearance, the Like Button loads Meta's full JavaScript SDK and initiates cross-site tracking on every page where it is embedded, regardless of whether the visitor interacts with the button or even has a Facebook account.

What This Script Does

The Facebook Like Button is implemented by loading Meta's JavaScript SDK from connect.facebook.net/en_US/sdk.js and rendering the button via an iframe or the FB.XFBML.parse() method.

Script Loading and Network Requests

When a page containing the Like Button loads, the following occurs immediately — before any visitor interaction:

• The sdk.js script is fetched from connect.facebook.net, establishing a connection to Meta's servers
• The SDK initializes with the site's Facebook App ID and sends a request to www.facebook.com to render the Like Button iframe
• Additional requests to www.facebook.com/plugins/like.php load the button UI and retrieve the current like count for the page

Cookies

The SDK sets and reads several cookies on the .facebook.com domain:

• _fbp — a first-party cookie set on the host website's domain (when the Meta Pixel is also present) that contains a unique browser identifier. Lifespan: 90 days. Used for advertising attribution and cross-site tracking.
• datr — a .facebook.com cookie that identifies the browser for security and integrity purposes. Lifespan: 2 years.
• fr — a .facebook.com cookie used for delivering and measuring the relevance of advertising. Lifespan: 90 days.
• sb — a .facebook.com cookie used for browser identification. Lifespan: 2 years.

For visitors who are logged into Facebook, the SDK reads their existing Facebook session cookies, enabling Meta to associate the page visit with their Facebook profile. For logged-out visitors, Meta still receives the page URL, referrer, browser fingerprint data, and the datr cookie, which allows cross-site tracking across any website that embeds Meta social plugins.

Data Transmitted to Meta

On every page load where the Like Button is present, Meta receives:

• The full URL of the page being visited
• The referring URL
• The visitor's IP address
• Browser user agent and screen resolution
• Any existing Facebook cookies (linking the visit to a Facebook profile for logged-in users)
• Timestamp of the visit

This data feeds into Meta's advertising platform for interest-based ad targeting, regardless of whether the visitor clicks the Like Button.

Consent & Compliance

The Facebook Like Button is classified under both marketing and functional categories. While the button provides a functional social sharing feature, its primary impact is marketing: it enables Meta's cross-site tracking and advertising data collection on every page load.

Under GDPR and ePrivacy, the Like Button requires explicit prior consent before loading. The Court of Justice of the European Union (CJEU) ruled in the Fashion ID case (C-40/17, July 2019) that website operators who embed the Facebook Like Button are joint data controllers with Meta for the data collection and transmission that occurs when the plugin loads. This means the site operator shares responsibility for obtaining valid consent before the SDK script is loaded.

The ePrivacy Directive requires consent for any non-essential cookie access or data transmission from the visitor's device. Since the Like Button transmits browsing data to Meta on page load for advertising purposes, it clearly falls outside the strictly necessary exemption.

Under CCPA/CPRA, the data transmitted to Meta through the Like Button constitutes "sharing" of personal information with a third party for cross-context behavioral advertising. A "Do Not Sell or Share My Personal Information" link is required, and the Like Button should not load for visitors who have opted out.

Should You Block This Without Consent?

Yes. The Facebook Like Button loads Meta's tracking infrastructure on every page view, transmitting visitor data to Meta for advertising purposes regardless of visitor interaction. Under EU law (including the CJEU Fashion ID ruling), you are a joint controller with Meta for this data collection and must obtain consent before the SDK loads. Block the connect.facebook.net script entirely until consent is granted.