rx_shariff for TYPO3

Why standard social buttons are a GDPR problem and rx_shariff was the solution

Every Facebook Like button, every Twitter share widget and every LinkedIn embed transfers personal data to the platform - on page load, not just on click. IP address, browser fingerprint and referrer flow to Facebook before the visitor even has the chance to consent. This was legally problematic even before the GDPR: over a Like button, a consumer organisation sued a website operator for an injunction, and the case went up to the CJEU.

rx_shariff implements the Shariff principle that the German publisher Heise developed in 2014 as a response to this problem: instead of embedding the platforms’ original widgets, rx_shariff renders its own privacy-compliant buttons. Only when a visitor clicks the button is a connection to the platform established. No tracking, no third-party requests, no cookies without interaction.

Typical use cases

Corporate websites with GDPR compliance requirements. A mid-market company wants to offer social share buttons on its blog articles without violating GDPR. The data protection officer has explicitly prohibited the standard widgets from Facebook and Twitter. rx_shariff delivers buttons that only establish a connection on click. The privacy policy can be correctly worded: “Only when actively using the share buttons is data transferred to third parties.”

Media websites with share counters. A specialist publisher wants to display under each article how often it has been shared on Facebook. rx_shariff offers this function through an optional backend proxy: the TYPO3 server queries share counts on demand from the platforms and caches the results. The platforms see only the server, never the individual visitor.

Intranet portals with controlled sharing. A company operates a TYPO3 intranet and wants to make specific articles shareable via LinkedIn while excluding Facebook and Twitter. rx_shariff can be configured so that only selected platforms appear as buttons. Configuration is done per page tree or per content element. In the intranet context, this is particularly relevant because accidental sharing of internal information on public platforms must be prevented.

Technical architecture

rx_shariff consists of two components: a frontend widget and an optional backend service.

Frontend widget: the TYPO3 plugin renders an HTML button for each configured platform. This button is a simple anchor link (<a href="...">) with a share URL as target. On click, the platform’s share dialog page opens in a new window. For this, the plugin loads the bundled Shariff JavaScript from your own server on page load; it sets no cookies and requests no external resources.

Backend service (optional): for share counters, rx_shariff operates a server-side proxy. An eID script queries the platform APIs (such as Facebook, Pinterest, Reddit, Xing) and stores the results in the TYPO3 cache. The frontend displays the cached counter. The proxy only fetches the numbers when a page requests them and keeps them in the cache for one hour by default. The platform APIs see only the server IP, never the website visitor’s IP.

Configuration is done through TypoScript and extension settings:

• Platform selection (Facebook, Twitter/X, LinkedIn, Xing, Pinterest, WhatsApp, Telegram, email)
• Display variant (icons, buttons with text, compact variant)
• Theme customization via CSS classes
• Share counter enable/disable
• Backend service URL for counters

Dependencies: TYPO3 Core. For the share counter: PHP with cURL support, for Facebook an app ID and secret from an app registration.

Common problems and solutions

Share counters always show 0. The Facebook API requires authentication: without an app ID and secret it returns no counters, and rx_shariff does not query LinkedIn counts at all. Twitter/X shut down its share count API entirely in 2015 - a counter for Twitter is technically no longer possible. Solution: create a Facebook app in the Meta Developer Portal and configure the app token in rx_shariff. Disable the counter for Twitter or switch to X API v2 with OAuth 2.0, which however does not offer a share counter.

Buttons not visible after TYPO3 update. rx_shariff uses a TYPO3 plugin with its own content element. If the plugin is no longer registered after an update (e.g. through changed Composer dependencies), the content element disappears from the frontend. Solution: check the extension in the Extension Manager, update Composer dependencies, run vendor/bin/typo3 cache:flush.

WhatsApp share works only on mobile devices. WhatsApp Web and the desktop app do not consistently support the whatsapp:// URL scheme. On desktop browsers, clicking the WhatsApp button leads nowhere. Solution: use the web URL https://api.whatsapp.com/send?text=... on desktop, the app scheme on mobile. Current versions of rx_shariff use the web URL on all devices.

Migration and version compatibility

rx_shariff is actively maintained by Reelworx and available as a stable Composer package in version 16.1.4 for TYPO3 v12, v13 and v14. rx_shariff now uses the fork Shariff-Plus; Heise’s Shariff JavaScript last appeared in 2019 as version 3.2.1.

For new projects from TYPO3 v12 onward, Gosign recommends a reassessment: simple share links (href="https://www.facebook.com/sharer/sharer.php?u=...") are lighter than rx_shariff, GDPR-compliant and require no extension. The downside: no share counter. Those needing counters must implement the API queries themselves or use a service like ShareThis with consent management.

Migrating from rx_shariff to simple share links typically takes half a day: remove old plugin, create new Fluid partials for share links, adjust CSS. Gosign has performed this switch for multiple clients and improved page loading time by 150 to 300ms because the Shariff JavaScript and counter queries are eliminated.

The simple share link approach covers the common platforms: Facebook (https://www.facebook.com/sharer/sharer.php?u={url}), LinkedIn (https://www.linkedin.com/sharing/share-offsite/?url={url}), X/Twitter (https://twitter.com/intent/tweet?url={url}&text={title}), email (mailto:?subject={title}&body={url}) and WhatsApp (https://api.whatsapp.com/send?text={url}). All links are privacy-compliant because no JavaScript is loaded and no third-party cookie is set. The links can be included as a Fluid partial in any template and styled via CSS classes.