Facebook has been ordered by a Belgian court to stop collecting data on users or face daily fines of €250,000 a day, or up to €100m.

The court ruled on Friday that Facebook had broken privacy laws by tracking people on third-party sites in the latest salvo in a long-running battle between the Belgian commission for the protection of privacy (CPP) and the social network.

“Facebook informs us insufficiently about gathering information about us, the kind of data it collects, what it does with that data and how long it stores it,” the court said. “It also does not gain our consent to collect and store all this information.”

Facebook has also been ordered to delete all data it had gathered illegally on Belgian citizens, including people who were not users of the social network.

The social media firm uses different methods to track the online behaviour of people if they are not on the company’s web site by placing cookies and invisible pixels on third party web sites, the court said.

Richard Allan, Facebook’s vice president of public policy for EMEA, said the company was disappointed with the verdict and intended to appeal: “The cookies and pixels we use are industry standard technologies and enable hundreds of thousands of businesses to grow their businesses and reach customers across the EU.

“We require any business that uses our technologies to provide clear notice to end-users, and we give people the right to opt-out of having data collected on sites and apps off Facebook being used for ads.”

Belgium v Facebook
The battle between Belgium and Facebook has been running since 2015, when the CPP commissioned a report by researchers from the University of Leuven, which found that Facebook’s tracking of all visitors without explicit consent using cookies breached EU law. The CPP, which does not have powers to directly penalise companies, took Facebook to court later that year for its alleged “trampling” over Belgian and EU privacy law after failing to come to an agreement with the social network following the report’s findings.

The Belgian court ordered Facebook to stop tracking non-members at the end of 2015, threatening fines. Facebook appealed against the court’s ruling at the start of 2016, disputing that Belgium had jurisdiction over the social network as its European operations were headquartered in Dublin. Facebook also disputed the use of English in the ruling including the words “browser” and “cookie”, which the social network said was against Belgian law that stipulates only Dutch, French or German may be used.

Facebook then won on appeal, overturning the decision that blocked it from using its so-called “datr cookies” to track the internet activity of logged-out users in Belgium. That appeal has now been overturned, with the court backing the findings of the CPP.

This is just one of many battles Facebook is fighting in Europe as the political winds have turned against the big US technology firms. The EU and European nations continually criticise Facebook for failing to do enough to tackle the rise of take news and to deal with extremist content.

Its WhatsApp messenger is also facing a task force from the European data regulator, the Article 29 Working Party, over its failure to adequately address concerns about getting user consent to share data with Facebook. The social network’s default privacy settings and use of personal data were recently ruled illegal by a Berlin court in Germany. France has also ordered the company to stop its sharing of WhatsApp user data, while Facebook was fined £94m by the EU for providing “misleading” information in its takeover of WhatsApp.

This is all on the eve of the introduction of tough new European data privacy rules, called the General Data Protection Regulation, which come into force on 25 May. Allan said: “We are preparing for the new General Data Protection Regulation with our lead regulator the Irish Data Protection Commissioner. We’ll comply with this new law, just as we’ve complied with existing data protection law in Europe.”