Share buttons
Share buttons and GDPR: what needs consent
Quick answer
Official share and like widgets load code from the network when the page opens, which can send the visitor's IP address and cookies before they click anything. In the EU and UK that generally needs prior consent. Plain share links send nothing until clicked, so they are the simplest way to stay compliant. This is general information, not legal advice.
On this page
The core distinction
What matters is whether anything is transmitted to a network before the visitor chooses to share. A plain link to a share URL transmits nothing until it is clicked, and clicking it is the visitor's own action. An embedded widget loads the network's script or iframe as the page loads, so the network can receive the visitor's IP address, browser details and cookies whether or not they ever share.
| Button type | Data sent on page load | Consent usually needed |
|---|---|---|
| Plain share link with local icon | None | No |
| Plugin counts fetched on your server | None from the visitor | No, but mention the processing |
| Official like or share widget | IP, browser data, network cookies | Yes, before loading |
| Icons loaded from a network CDN | IP and browser data | Likely, better to self-host |
Why site owners share responsibility
In the Fashion ID case (C-40/17, 2019), the Court of Justice of the EU held that a website embedding a social plugin can be a joint controller with the network for the collection and transmission of visitors' data at that stage. That is why the old documentation for share plugins, including the GDPR page for this domain's former plugin, pushed site owners toward non-tracking buttons.
The two-click pattern
If you need an official widget, for example a live like count, show a static placeholder first. The first click enables the widget, the second click uses it. Your consent tool can also block the widget until the relevant category is accepted.
What to write in your privacy policy
- Which share buttons you use and whether they load anything before a click.
- If you fetch share counts on your server, which services you query and that no visitor data is sent.
- For any consent-gated widget, which network it loads and a link to that network's policy.
- That clicking a share button takes the visitor to the network, whose own terms then apply.
Questions
Do share buttons need a cookie banner?
Plain share links do not set cookies or send data before a click. Official widgets usually need consent before they load.
Is a plain Facebook share link GDPR compliant?
A link that only opens the share dialog when clicked sends nothing beforehand, which is why it is the common compliant choice.
Is this legal advice?
No. It is general information. Check your own setup with a qualified adviser for your jurisdiction.
Hannah Voss, Editor. Checks every guide against a working WordPress install and the networks' current documentation. Last reviewed September 2026.
Related guides
- Share buttons and page speedWhy some share buttons slow WordPress pages and others cost almost nothing. How to measure the impact, and what to change to keep sharing fast on every page.3 min read
- Follow prompts, like bars and share popupsAfter-share follow prompts, Facebook like bars and share popups: what they were, which still work, and how to ask for a follow without annoying readers.3 min read
- Privacy policyWhat mashshare.net collects: no accounts or cookies, privacy-first cookieless aggregate analytics from our hosting network, server logs, and your rights.