Facebook Tracks Offline Users

The social-networking site acknowledges that its Beacon ad service tracks even logged-off users who are visiting their partner's website.

Facebook Tracks Even Logged-Off Users
The social-networking site Facebook confirms the findings of a CA security researcher that its Beacon ad service is more intrusive and stealthy than previously acknowledge. This contradicts the statements previously made by Facebook executive and representatives.

The ad service, Beacon, tracks users' off-Facebook online activities even if those users are logged off from the social-networking site. The Beacon tracks user's online activities on specific external websites and broadcasts it to their Facebook friends. Although this feature has an option to opt-out, Beacon still transmits data gathered to Facebook servers even if the user has previously declined to use Beacon.

According to a company spokesman, Facebook does nothing with the data transmitted back to its servers, and, in these cases, deletes it. The admission will probably fan the flames of the controversy engulfing Beacon, which has been criticized by privacy advocates.
The Facebook spokesman did not initially reply to a request for further explanation on how the Beacon action gets triggered if a user is logged off from Facebook, when the social-networking site's ability to track its users' activities should be inactive. It's also not clear whether the website plans to modify Beacon so it doesn't track and report on the off-Facebook activities of logged-off users.

Beacon is a major part of the Facebook Ads platform that the website introduced with much fanfare several weeks ago. Beacon tracks certain online activities of Facebook users on more than 40 participating websites, including those of Fandango and Blockbuster. These include purchasing a product, signing up of a service, and including an item on a wish list. It then reports those activities to the users' set of Facebook friends.

The program has been blasted by groups such as MoveOn.org and by individual users who have unwittingly broadcast information about recent purchases and other Web activities to their Facebook friends. This has led to some embarrassing situations, such as blowing the surprise of holiday presents.

On Thursday night, Facebook tweaked Beacon to make its workings more explicit to Facebook users and to make it easier to nix broadcast messages and opt out of having activities tracked on specific Web sites. Facebook didn't go all the way to providing a general opt-out option for the entire Beacon program, as some had hoped.

Facebook users are not informed that data on their activities at these sites is flowing back to Facebook, nor given the option to block that information from being transmitted.

If users have ever checked the option for Facebook to "remember me" -- which saves users from having to log on to the site upon every return to it -- Facebook can tie their activities on third-party Beacon sites directly to them, even if they're logged off and have opted out of the broadcast. If they have never chosen this option, the information still flows back to Facebook, although without it being tied to their Facebook ID, according to Stefan Berteau, senior research engineer at CA's Threat Research Group.

Facebook's admission over the weekend contradicts previous statements from the company regarding this issue. For example, in e-mail correspondence with Facebook's privacy department, Berteau was told, among other things, that "as long as you are logged out of Facebook, no actions you have taken on other websites can be sent to Facebook."