- FACEBOOK collects, without prior information, data concerning the browsing activity of Internet users who do not have a FACEBOOK account. Indeed, the company does not inform Internet users that it sets a cookie on their terminal when they visit a FACEBOOK public page (e.g. page of a public event or of a friend). This cookie transmits to FACEBOOK information relating to third-party websites offering FACEBOOK plug-ins (e.g. Like button) that are visited by Internet users.
- The social network collects data concerning the sexual orientation and the religious and political views without the explicit consent of account holders. In addition, Internet users are not informed on the sign up form with regard to their rights and the processing of their personal data.
- The website also sets cookies that have an advertising purpose without properly informing and obtaining the consent of Internet users.
- FACEBOOK compiles all the information it has on account holders to display targeted advertising (information provided by the Internet users themselves, collected by the website and by other companies of the group, and transmitted by commercial partners). As it is, the company provides no tools for account holders to prevent such compilation, which thereby violates their fundamental rights and interests, including their right to respect for private life.
- FACEBOOK transfers personal data to the United States on the basis of Safe Harbor, although the Court of Justice of the European Union declared invalid such transfers in its ruling of October 6, 2015.
According to Fortune, the larger challenge to Facebook in the CNIL notice is its clear opposition to the profiling of users, which could hammer the advertising giant’s business model and profits. Regulators in Belgium, the Netherlands, Spain and Hamburg have been working with the CNIL on these profiling issues and additional enforcement actions directed against Facebook can be anticipated from them as well.
Facebook's response to the CNIL order? A spokesperson was quoted as saying "We are confident that we comply with European data protection law and look forward to engaging with the CNIL to respond to their concerns." Such confidence, ill-advised and arrogant, hardly reflects well upon the acuity of Facebook's legal team if taken at face value.