Last Updated Sep 26, 2011 5:37 PM EDT
It's another example of Facebook's repeated privacy creep. Over time, the company keeps trying to learn more about all its users, pushing for a future where current notions of privacy simply don't exist. Now, depending on what apps and settings you use, it will be possible for things you read and see to appear on Facebook without your having to actually do anything. Not even click a "like" button. But it goes even further. Developer Nic Cubrilovic realized that Facebook can track every page you read even if you log out of the site. That means there is no getting away from Facebook tracking for many people.
Cubrilovic first noticed odd things about Facebook last year. As part of a development project, he had to create multiple profiles on the service. He'd log into one, log out, and then use another. Facebook would start suggesting the various fictitious people as possible friends. The service sets cookies that identify the browser to Facebook after sessions.
Leaving a cookie for later use is nothing new on the Internet. Nor is associating a particular account with a given computer and browser. Advertising networks do it all the time.
A Facebook spokesperson pointed to an engineer's comment on our sister site ZDNet, who said that the cookies are used for various reasons, but not for tracking people. Perhaps that's true. Perhaps not. The company has yet to provide an official statement on the issue, and one engineer might not know everything done by the site. Also, any statement that Facebook does not "share or sell" user data may be technically correct. But the company can still use the data internally to better direct ads.
[Update: A Facebook spokesperson emailed the following statement:
- Do your open graph partners have the ability to read and interpret the cookies?
- Do they send information back to you?
- How can you show what friends liked if you don't keep a record of what they've done, which would seem to be the same as tracking?
- How can you measure click-through rate of users using "cookies on social plugins" if someone isn't monitoring who is doing what and where it's happening?
- Since your system often does know who the person previously logged in was and is looking for a password, how is that not the same as staying logged in? That is, still knowing who the person is?
- If you don't use any information from social plugins to target ads, what do you do with the information?
What makes this question particularly thorny is how interconnected Facebook seeks to become with so many other parts of the Web, and how an increasing number of major sites that will modify their apps to connect with Facebook's Open Graph. Here are a few that announced with Facebook:
- The Guardian
- The Daily
- The Independent
- The Washington Post
Many who use Facebook who don't like the idea of other sites reporting information back have typically logged out of the system before going elsewhere. (I know I have.) What Cubrilovic argues is that this does no good:
But logging out of Facebook only de-authorizes your browser from the web application, a number of cookies (including your account number) are still sent along to all requests to facebook.com. Even if you are logged out, Facebook still knows and can track every page you visit. The only solution is to delete every Facebook cookie in your browser, or to use a separate browser for Facebook interactions.When users log out, Facebook still leaves cookies intact that identify users as particular members, even though the site may say that you have logged out. Effectively, you don't get to log out.
Interestingly, Cubrilovic claims that he tried for a year to talk to Facebook about this, only to get no response. He says he finally went public with it because of the potential privacy issues with the company's announcements last week. If so, it wouldn't be that surprising. Facebook is a company that makes money by helping advertisers to use consumers' personal information to better target marketing. It loses information if someone can log out.
When you have to remember what not to share
As Dave Winer notes, there's an intrinsic ethical difference between using information people post about themselves and seeking out other data that you can find by following them. If you can track someone from site to site, it's as though you followed them in an unmarked car and took notes about everything they did.
The practical problem for many is that without the explicit step of posting something onto their accounts (and that can happen in some cases just by clicking a like button), they could easily forget that everything -- everything -- on a given site could go hurtling back to become public knowledge. What if they were reading about finding a new job and their bosses were connected through Facebook? What if they had some medical condition they didn't want widely known? Too bad and too late: it's already out there.
- Facebook's Dilemma: Its New Features Are All About Zuck's Life, Not Yours
- LinkedIn Pushes Its Users Into Ads Because It Can (and Wants That Money)
- Technology Has Become the Marketing Snoop's Scapegoat
- Desperate Groupon Tries to Fix Finances with Consumer Privacy
- Facebook's 5 Step Plan to Ignore Privacy and Collect More Personal Data