Facebook’s “Like” button makes third-party websites responsible for processing people’s data under the European Union’s privacy rules, according to the EU’s top court.

The EU Court of Justice examined a dispute between an online fashion retailer and a local consumer association, which claimed that by embedding a Like plugin to a website, the online fashion retailer allowed the social media company to collect data on the site’s users.

According to the ruling issued by the Luxembourg-based court, the owner of a website can be held jointly responsible for “the collection and transmission to Facebook of the personal data of visitors to its website.” “By contrast, that operator is not, in principle, a controller in respect of the subsequent processing of those data carried out by Facebook alone.” The decision can’t be appealed.

Belgium’s data protection regulator said last year a ruling making websites jointly liable could have “serious repercussions” for website operators.

The case dates back to before the EU enacted much stricter privacy rules with its General Data Protection Regulation, or GDPR.