The core distinction
What matters is whether anything is transmitted to a network before the visitor chooses to share. A plain link to a share URL transmits nothing until it is clicked, and clicking it is the visitor's own action. An embedded widget loads the network's script or iframe as the page loads, so the network can receive the visitor's IP address, browser details and cookies whether or not they ever share.
| Button type | Data sent on page load | Consent usually needed |
|---|---|---|
| Plain share link with local icon | None | No |
| Plugin counts fetched on your server | None from the visitor | No, but mention the processing |
| Official like or share widget | IP, browser data, network cookies | Yes, before loading |
| Icons loaded from a network CDN | IP and browser data | Likely, better to self-host |
Why site owners share responsibility
In the Fashion ID case (C-40/17, 2019), the Court of Justice of the EU held that a website embedding a social plugin can be a joint controller with the network for the collection and transmission of visitors' data at that stage. That is why the old documentation for share plugins, including the GDPR page for this domain's former plugin, pushed site owners toward non-tracking buttons.
A share buttons GDPR audit, step by step
Open a post in a private window
Logged out, with your consent tool set to reject everything. Open the browser's network panel and reload.
Filter by third-party domains
Any request to a social network's domain before you click anything is the finding. Note the domain and the initiator column, which names the script that made the call.
Check cookies
In the application or storage panel, list cookies set by domains other than your own. Network cookies set on load confirm a widget is running.
Map each request to a button
Turn share plugin settings off one at a time and reload, until the third-party requests stop. That tells you which setting loads the widget.
Replace or gate
Swap each offending widget for a plain link, or put it behind the two-click pattern or your consent tool's category.
Update the privacy policy
Describe what remains, in the terms below, and record the date of the audit.
Worked example: what an audit finds
The findings below are invented but typical of a blog that installed a share plugin some years ago and left the defaults on. The audit took one post, one private window and about twenty minutes.
| Finding | Requests on load | Cookies set | Action |
|---|---|---|---|
| Official like button in the sidebar | 4 to a network domain | 2 | Removed; replaced with a follow link |
| Share plugin loading its icon font from a CDN | 1 to a CDN | 0 | Self-hosted the font, then replaced it with inline SVG |
| Share counts fetched by browser script | 3 to count endpoints | 0 | Switched to server-side fetching with a 6 hour cache |
| Plain share links in the row | 0 | 0 | Kept |
| Embedded video with the network's player | 6 to the video host | 3 | Switched to the host's no-cookie embed domain and gated it |
After the changes the post makes no third-party request on load, sets no third-party cookie, and still shows a full share row. The one gated element, the video, shows a placeholder until the reader clicks. The privacy policy gained three sentences and lost a paragraph about network cookies that no longer applied.
The two-click pattern
If you need an official widget, for example a live like count, show a static placeholder first. The first click enables the widget, the second click uses it. Your consent tool can also block the widget until the relevant category is accepted.
What to write in your privacy policy
- Which share buttons you use and whether they load anything before a click.
- If you fetch share counts on your server, which services you query and that no visitor data is sent.
- For any consent-gated widget, which network it loads and a link to that network's policy.
- That clicking a share button takes the visitor to the network, whose own terms then apply.
What goes wrong
- Auditing while logged in. Admin sessions skip caches and sometimes consent tools, so the panel shows a different page from what visitors get.
- Consent tool that hides rather than blocks. Some tools hide the widget with CSS after it has already loaded. The request and the cookie still happened. The tool must prevent the script from loading.
- Share counts that leak. A plugin that fetches counts from the browser sends the visitor's IP to each count endpoint on every view. Server-side fetching sends only your server's requests.
- Fonts and icons from a CDN. Easy to miss because the domain is not a social network. It is still a third party receiving IP addresses.
- Old widgets in widgets areas. A like box added to the sidebar years ago and forgotten. Check every widget area and every footer.
- Treating this page as legal advice. It is general information. Rules and their interpretation vary by country and change over time.
Check it worked
- A private window with consent rejected shows no request to any network or CDN domain on page load.
- No third-party cookie appears in the storage panel before a click.
- Every share button still opens its dialog with the right address when clicked.
- Gated widgets show a placeholder and load only after the click or the consent category.
- The privacy policy describes exactly what the network panel shows, and the audit date is recorded.
The same requests that raise a consent question also cost load time, which is why the audit above overlaps with measuring share button page speed. The follow prompts and like bars that most often introduce widgets are covered in like bars and follow prompts; other guides are on the share buttons hub, and this site's own practices are in its privacy policy.
Sources
- Regulation (EU) 2016/679, the GDPR (EUR-Lex)
- Court of Justice of the EU, case C-40/17 Fashion ID (embedded share plugins)
- UK ICO: guidance on cookies and similar technologies
Questions
Do share buttons need a cookie banner?
Plain share links do not set cookies or send data before a click. Official widgets usually need consent before they load.
Is a plain Facebook share link GDPR compliant?
A link that only opens the share dialog when clicked sends nothing beforehand, which is why it is the common compliant choice.
Is this legal advice?
No. It is general information. Check your own setup with a qualified adviser for your jurisdiction.
How do I check whether my share buttons send data?
Open a post in a private window with consent rejected, watch the network panel on reload, and look for requests to network or CDN domains before any click.
Do share counts need consent?
Counts fetched by your server send nothing from the visitor and need only a mention in the policy. Counts fetched by the browser send the visitor's IP to each service and are best avoided.
Hannah Voss, Editor. Checks every guide against a working WordPress install and the networks' current documentation. Last reviewed September 2026.
Related reading
- Share buttons and page speedWhy some share buttons slow WordPress pages and others cost almost nothing. How to measure the impact, and what to change to keep sharing fast on every page.5 min read
- Follow prompts, like bars and share popupsAfter-share follow prompts, Facebook like bars and share popups: what they were, which still work, and how to ask for a follow without annoying readers.5 min read
- Privacy policyWhat mashshare.net collects: no accounts or cookies, privacy-first cookieless aggregate analytics from our hosting network, server logs, and your rights.