The EU’s top court has ruled that companies that embed Facebook’s “Like” button on their Web sites must seek users’ consent to transfer their personal data to the US social network.

This follows legal action by a German consumer body that sued online retailer Fashion ID for breaching personal data protection rules via its use of the button on its site.

The German court sought guidance from EU judges, who ruled that Web sites and Facebook share joint responsibility.

Under EU data privacy rules, the court found the operator of a site that features a Facebook “Like” button can be a controller jointly with Facebook in respect of the collection and transmission of the personal data Web site users.

In other words, companies that use “Like” buttons on Facebook are responsible for any data they collect.