Facebook Privacy: Site Confirms It Tracks You After You Leave

http://abcnews.go.com/Technology/facebook-tracking-scrutiny/story?id=14960711&singlePage=true

by rams • 15 years ago

136 68 15 years ago

abcnews.go.com

rosser• 15 years ago

This is why I visit Facebook in one browser, G* in another, and everything else in yet a third.

folkster• 15 years ago

There is not much use switching browser. They tracks you using cookies even if you dont login(like button and other plugins) You need to block/remove all the facebook related cookies.

untog2• 15 years ago

Cookies do not cross browsers. If he's using a second browser, Facebook cannot read the cookies set in the first browser. They could use some IP matching logic or something, but it would be prone to a lot of false positives.

bho• 15 years ago

I would recommend making a Facebook VM if you really want to get on. This helps on two fronts: 1) You must REALLY want to get on facebook if you go through the extra step of booting up a VM 2) They can track all they want inside your VM since you use it ONLY for facebook.

/s/facebook/any other social service you intend to use.

wedesoft• 15 years ago

It's much easier to just use Adblock to block third party code from Facebook and others when viewing web pages.

http://www.fanboy.co.nz/

toffer• 15 years ago

Better yet, use Fluid[1] and create a single site browser for Facebook. Make sure you use the paid version of Fluid App, so you get separate cookie storage for each SSB you set up.

[1] http://fluidapp.com

iamandrus• 15 years ago

Facebook has said that it's rooting for an "open web", but it can't even be honest about what data it's collecting, how much tracking is done, and how that data is used by the company.

A scary aspect of Facebook is that most users are completely unaware and care-free. Their friends are on there, so why should they leave? A lot of my friends are leaving for Twitter because of the recent porn spam and the ticker nonsense, but that's a tiny chunk of the userbase (maybe a few hundred at the most).

psychotik• 15 years ago

Wait, how is this even technically possible?

Sure, Facebook can see sites you visit which use Facebook Connect in some form, but can they actually "create a running log of the web pages that each of its 800 million or so members has visited during the previous 90 days" like the article claims?

raganwald• 15 years ago

They can certainly track visits to those sites displaying a Facebook “Like” button or other FB spoor.

jamie_ca• 15 years ago

When your browser requests the like button from FB's servers, the request includes a session cookie, and the referer header indicating which page the like button was loaded from. Super easy to log, though it does generate a boat-load of data.

droz• 15 years ago

I'd like to think that developers wouldn't implement this kind of functionality on ethical grounds -I bet there are some at facebook who refused- but I also bet there are some there who will do anything for buck no matter how questionable it is.

alain94040• 15 years ago

To be fair, Google is doing the exact same thing with adwords and adsense.

esk• 15 years ago

Doesn't Google Analytics also phone home? Google's tracking is far more widespread than Facebook's if that's the case.

sp332• 15 years ago

Google Analytics seems somehow less harmful than AdSense. Almost every big website has some kind of analytics running. I assume that GA data isn't sold to advertisers, but I'm not sure.

thematt• 15 years ago

Would Ghostery be successful at blocking this?

http://www.ghostery.com/

william42• 15 years ago

I'm pretty sure this is exactly what Ghostery and the like block.

JonnieCache2• 15 years ago

Yep. It blocks the Like buttons and other stupid widgets, which is how the cookies get sent. That also has the pleasant side-effect of drastically decreasing load times.

I highly recommend it. Be aware that it does block disqus by default, I usually whitelist that one.

Periodic2• 15 years ago

I had a few problems with the blocking when actually going to the sites in question. I believe I had to unblock Google Plus, Google Analytics and Facebook when actually visiting those sites.

However, I'm happy that most of the time it prevents the annoying features of a page from loading.

brador• 15 years ago

Would using noScript with firefox work?

kogir• 15 years ago

Just disable reading and writing of third party cookies. I've been using this option in Chrome for quite some time.

Hint: Facebook is not alone in doing this.

icebraining2• 15 years ago

Cookies aren't the only way to be tracked, unfortunately. I don't know if it still works, but some sites were using custom ETags to track users.

Periodic2• 15 years ago

The part that scares me is that we, as web designers/developers/owners, are complicit in this. We are the ones who are putting social buttons on every page. We love this functionality, but they aren't giving it to us for free. We are trading them our user's information and browsing habits.

I'm not worried about the ethics of Facebook. I don't think a site like Facebook should be prevented from doing this openly. I'm worried about whether I can ethically include all these social plugins knowing that they will, in my opinion, invade my users' privacy.

icebraining2• 15 years ago

Use one of those proxy buttons which only load the actual Facebook button when the user clicks/hovers. Unfortunately I can't find it right now, but I think it was posted here on HN a while ago.

EDIT: Here is a Slashdot discussion[1] about a German newspaper who did that, and here's[2] the link to their jQuery plugin who does just that: only load FB code when the user clicks on the button. It's in German, but translation services are good enough nowadays.

EDIT2: And here's[3] the HN discussion.

[1] http://slashdot.org/story/11/09/03/0115241/Heises-Two-Clicks...

[2] http://www.heise.de/extras/socialshareprivacy/

[3] http://news.ycombinator.com/item?id=2957119

wl• 15 years ago

I'm not a web dev so I'm a bit puzzled by the social buttons everywhere. How often do people actually click them? To what extent can they drive traffic to your site? I've often wondered if they're a bit like QR codes in that a small portion of people are enamored with them but few people actually use them.

jka• 15 years ago

They serve a few purposes - I'll try and illustrate from various points of view.

* As a site operator, particularly if you're keen on 'organic' and free traffic, you need to keep on top of the latest in search engine and social marketing. Facebook and other social networks are becoming more important as traffic sources, as 'recommendations' from friends become more trusted. Bing and Facebook reached a deal to prioritize some results based on social recommendations ('likes'), and Google is rolling their own solution, so site owners have incentives to include the links.

* As a user, you generally want to see the most trusted results you can, and occasionally may want to recommend sites to your friends. Facebook's verbs 'like' and 'share' work well here - Google's '+1' is a little more opaque to most web users I'd suspect, but they're trying to convey the same intention.

* As Google/Facebook, you want as much data as possible about the behaviour of web traffic - search, engagement/interaction, conversion rates, even raw traffic figures. Even if people aren't interacting with these widgets, they are still often served up by AJAX from the source. This implies that Google/Facebook/etc see an incoming HTTP request, and sometimes associated cookies/referers. Add a little GeoIP and other user analysis, and you have very valuable data on aggregate.

All these generally seem like 'wins' for the parties involved - and that's usually the sign of good business taking place. For me, the main concern is that all this data belongs not to the general public, but to the widget providers, and large information disparities in any situation can be abused.

steve-howard• 15 years ago

Definitely. I rarely bother with Facebook any more, but when I want to share something, copy and paste is not hard. The "social buttons" don't solve a problem, IMO.

actually, what started the decline was the very subject of this article. I don't like Facebook watching where I go, and I started putting Facebook in another browser; naturally, I'm on Facebook less because it's harder to get to.

mike-cardwell• 15 years ago

Proud to not be a part of this "we". These social buttons are a plague on the web. They take something which is beautifully decentralized, and then create a single point of failure, and allow companies to create massive databases of private information from it as well.

You can host an image locally, and create a link using it. You don't need to hand over the browser of all of your visitors to one or more AD companies by letting them execute arbitrary JavaScript on your pages.

ceol• 15 years ago

I think your parent post was talking about the Facebook Like/Google+ +1 buttons. In order for those to work, I believe they need to be loaded on the page via an iframe.

Things like Facebook's "share" and Twitter's "tweet" buttons don't execute any arbitrary (i.e. not specified by the developer) JavaScript.

pork• 15 years ago

Um...ad networks have been doing the same thing with 1px images since the mid 90s. The social buttons are not a new concept in tracking; it's just visible to users now.

101001011• 15 years ago

Yup. You are making your own future. As the enablers, your choices are guiding what these companies can do. Zuckerberg's ethics (lack thereof) are well-known. But the upper management of Facebook, their lawyers, their financiers, the folks who buy access to the personal data, they cannot write code. You are not just some code monkey drone, following instructions from your boss or taking feature requests from naive end-users, _your_ choices, _your_ ethics, make a difference.

What was it that Dennis Ricthie said about his move to Bell Labs? Something like "It was 1968 and working on military projects just didn't feel right." He went on to make an enormous contribution and, we hope, preserved his peace of mind at the same time. You will never regret taking the high road. Just an opinion.

cpeterso5• 15 years ago

I am reminded of Pigdog's 2002 open letter/rant to the Sony engineers who wrote the CD DRM code that would brick iMacs.

WARNING: STRONG LANGUAGE! ;)

"d00d, Quit being a FUCKING ASS": http://www.pigdog.org/auto/software_jihad/link/2581.html

rblion• 15 years ago

Big Brother Blue is always watching.

It is becoming more and more obvious that we are nothing more than a pile of data to facebook, they don't look at us human beings who have a need for respect and privacy, but as potential data and revenue. I have always gotten the feeling that they think we are 'too dumb' to catch on, it's only a matter of time until the bubble bursts. They may still be a billion dollar company but the respect and loyalty will shift when something greater is envisioned and realized.

cheap• 15 years ago

+1 I couldn't have said it better myself.

moozeek• 15 years ago

As a side note, according to Ghostery the publishing site abcnews.go.com is using 13 external tracking services, including Facebook.

americandesi3332• 15 years ago

Question- Would people be more willing to let a platform track browsing activity if there was 100% transparency? Asking this question for the startup that we are working on, where we want to get permission from users to follow their certain activities- which is directly applicable to the platform value.

rhizome2• 15 years ago

It's hard to say without seeing it. Implementation is everything, but opt-in-wise, it sounds like you're describing browser bars. Maybe it's time to resurrect browser bars for the social age? :) Good luck!

americandesi3332• 15 years ago

When you say 'browser bars' I am thinking of an address bar in browsers today. Is that what you are referring to?

I am thinking of something that does not interact with the user but captures some of their web usage based on their consent. Would love to share it with the community when its ready!

firefoxman1• 15 years ago

It sucks that Facebook can get away with this but services like KISSMetrics and ad networks get sued for tracking users...even though that's what the goal of analytics is, whereas Facebook's job is to provide a social network that protects its users' data.

drumdance• 15 years ago

Seems like a distinction without difference. If Facebook weren't doing this on their own they would very likely be working with someone like KISSMetrics.

GoodIntentions• 15 years ago

No Script + RequestPolicy + AdBlock ftw.

This combo makes your browsing a little frustrating, but very educational. Try it, even for a day and be amazed at how many sites load content and scripts from 8, 10, or more unrelated domains.

I gave up trying to keep an up-to-date host file for all the web beacon/scam urls. I just vet requests now as they occur. You wanna believe it has changed my surfing habits.

lurchpop• 15 years ago

solution is to install the adBlockPlus extension, open up any page, say, techcrunch.com, then open the extension dialog and block external domains like twitter, facebook, google, google-analytics, etc.

nickand• 15 years ago

Do you need the paid version to block external domains?

modeless• 15 years ago

The hypocrisy of news sites decrying Facebook's tracking while putting Like buttons on every page is palpable. (There are no less than five different Facebook widgets on this article's page, plus multiple Twitter and Google+ buttons.) The reality is that website owners are the ones sending Facebook this data.

orijing• 15 years ago

> Bejar acknowledged that Facebook could learn where specific members go on the Web when they are logged off by matching the unique PC and browser characteristics logged by both the session cookie and the browser cookie.

> He emphasized that Facebook makes it a point not to do this. " We've said that we don't do it, and we couldn't do it without some form of consent and disclosure," Bejar says.

A better title would be "Facebook /could/ track users via the Like widgets, but doesn't do it yet"

bobwaycott• 15 years ago

Doesn't it seem like time for a browser to get involved in protecting privacy? Maybe that's a stupid question. This just leaves me thinking I'd really like it if my browser only shared my cookies when I'm actually visiting the site requesting them, else it'd ignore the requests altogether.

No doubt that's either dumb, not possible, or something someone already thought of.

ahrjay• 15 years ago

There is the do not track initiative[1] but it's kind of a pretty please solution.

[1] http://dnt.mozilla.org/

dspillett• 15 years ago

This is why I keep facebook in a separate browser. The could technically still track me using flash cookies but as the site isn't on my "can play flash content" whitelist this is no issue either.

It means I can't comment on a growing number of sites that use fb for their comments system, but that is no loss to me in my not-so-humble opinion.

Facebook Privacy: Site Confirms It Tracks You After You Leave

Related Stories