Data controller
The data controller is the person or organization that determines the purposes and means of processing personal data, and therefore carries the legal responsibility for it.Article 4(7) of the GDPR defines the controller as the natural or legal person, public authority or body which, alone or jointly with others, determines the purposes and means of the processing. The controller must have a legal basis, inform people, honor their rights, keep records, secure the data and be able to demonstrate compliance (Article 5(2)). It can be fined under Article 83. Brazil's LGPD calls it the controlador, South Africa's POPIA the responsible party, Türkiye's KVKK the veri sorumlusu.
A website operator is the controller for the cookies set through its pages, including those of third parties it chooses to embed. The Court of Justice held in Fashion ID (C-40/17, 29 July 2019) that a site embedding Facebook's Like button is a joint controller with Facebook for the collection and transmission of visitors' data, and must obtain the consent and give the information for that stage. The same reasoning applies to pixels, embedded videos and advertising tags. In IAB Europe (C-604/22, 7 March 2024) the Court found that an industry body setting the rules of a consent framework can be a joint controller too.
Joint controllers must agree on who does what (Article 26). Vendors that process only on the site's instructions are data processors instead; many advertising platforms act as controllers for their own purposes, which the contracts and the cookie policy should say.