Where several operators are jointly responsible for the same processing, the law does not require each of them to have access to the personal data concerned.

If you are a publisher, you better toss aside those ‘secret’ service provider data protection addendum and get ready to embrace ‘public’ joint-controller agreements with Facebook and other providers of plugins.