Facebook Beacon Privacy Issues Worse Than Previously Thought?

An anonymous reader writes "Further developments in the Facebook Beacon affair ... According to PC World, a Computer Associates researcher claims that Beacon, when installed on participating sites, is sending data about users' activity back to Facebook, even when a user is logged out of Facebook - despite Facebook's claims to the contrary."

How to avoid Beacon

[Conanymous Award]

From a comment on TFA:

Facebook users who also use Firefox to browse the we can prevent facebook's beacon from reporting by doing the following: download the BlockSite Add-on for The Firefox Browser. Under the tools menu, select "add-ons" Select the BlockSite Add-on and edit the preferences. Under the Blacklist, add a new site with the "add" button. enter the URL "http://*facebooks.com/beacon/* Hit return twice and you are good to go.

I wonder if he actually meant "*facebook.com" without an S, though.

Re:Let them know

[arth1]

Um, why bitch at kongregate.com or other sites for using Beacon, instead of just ditching Facebook? Without a Facebook account, this won't a problem on any site.

Re:Let them know

[Volfied]

Actually, you can't delete a Facebook account, only deactivate it. After reading the PC World article a couple days ago, I tried to delete mine, and was told that I could log back in any time and it would be ready and waiting for me. Something tells me they don't stop mining data from other sites just because you've deactivated the account, when they're not even willing to delete your favorite brand of toilet paper from your profile. I wiped every bit of information about me by hand, aside from my wall posts, which were simply too numerous.

Block the "Feature"

[ZlatanZ++]

This [wikihow.com] might be useful for some people. It shows you how to block Facebook's Beacon.

Re:Block the "Feature"

[empaler]

Basically, it tells you to go to addons.mozilla.org, find blocksite, install, add "http*://*facebook.com/beacon/* to blocksite, and gold. Should work in AdBlock/ABP too, PeerGuardian, or whatnot.

Re:Let them know

[XSpud]

There are also a number of Beacon-related groups and petitions on Facebook including:

http://www.facebook.com/group.php?gid=7578845355/ [facebook.com]
http://www.facebook.com/group.php?gid=7534656429/ [facebook.com]
http://www.facebook.com/group.php?gid=6290193865/ [facebook.com]
http://www.facebook.com/group.php?gid=6188991025/ [facebook.com]

Facebook == new Google

[ThirdPrize]

Google stopped becoming a search engine and is now an advertising company that does a bit of searching on the side. Same will happen to Facebook. You might use it as a social networking site but it WILL become more concerned with getting ads on screen.

Earning user trust requires honesty.

[zestyping]

The problem here isn't just that Facebook is collecting private information. Any company could say "look, if you use our service, here's what we're going to collect and what we're going to do with it," make a good-faith effort to inform everybody what's about to happen and how it works, and then proceed.

The problem is that Facebook is lying about it, and doing so repeatedly.

1. Zuckerberg led the press and advertisers to believe [nytimes.com] that Beacon would be opt-in (it would publish only with the user's consent) but launched Beacon as an opt-out feature (it published without the user's consent).
2. Both the original design [facereviews.com] and the current design [facereviews.com] of Beacon announce to the user that a story is being sent to their profile. They do not present themselves as a choice; they do not ask for consent; they present themselves as a notification that something is already occurring.
3. Even though the new design is "opt-in", the notification has only one clearly emphasized button: "Okay". A design that offered a true choice would offer two equally clear buttons (e.g. "Publish" and "Cancel"). Again, the design is crafted to give users the impression that they have no choice.
4. Facebook collects information about its users' activities on other sites through Beacon despite public statements to the opposite. According to Stefan Berteau [ca.com], Facebook does this even when you are logged out and even when no notification is displayed.
5. Facebook did not give its users reasonable advance notification that it would start publishing information about their activities on other sites. It just went ahead and did it. And Facebook is still not being upfront about the fact that it is collecting this information.
6. Facebook continues to refuse to let users just turn off Beacon. Instead users have to individually refuse Beacon for each partner site, and they cannot do this in advance; they can only do it at the moment a partner site is about to publish a story on Facebook. Again, they are clearly trying to maintain as many obstacles as possible for users who simply don't want this information shared.
7. Facebook's official response [facebook.com] is disingenuous and insulting. The problem is not that Beacon "can be kind of confusing"; it is obviously designed to mislead. Facebook's Paul Janzer wrote:

   While we know "global opt-out" seems like the easiest solution, we believe that if we provide you with full control over your information, you and your friends can get the full benefit of sharing information and connecting on Facebook.

   Of course, if they really wanted to provide users "full control over [their] information" they would let users turn Beacon off.

A Facebook Satement in Response

[Stefanwulf]

CA received a statement from Facebook [ca.com] following their blog entries, which speaks to the use of this data.

Re:Not sure how this works

[cbart387]

From the horse's mouth on their techniques (emphasis mine).

Third Party Advertising

Advertisements that appear on Facebook are sometimes delivered (or "served") directly to users by third party advertisers. They automatically receive your IP address when this happens. These third party advertisers may also download cookies to your computer, or use other technologies such as JavaScript and "web beacons" (also known as "1x1 gifs") to measure the effectiveness of their ads and to personalize advertising content.

See original here [facebook.com].

Re:How do they know?

[Anonymous Coward]

The third party sites don't. They call a javascript file hosted on facebook.com every time the page is loaded. If the user has ever used the "remember me" option when logging into Facebook, then a facebook.com cookie with their login email is stored on the computer, and returned along with the request to facebook.com, which means that Facebook gets the information directly from the user along with the variables being passed by the third party web page.

Facebook is dead

[CaptainZapp]

So they have a zillion of members and is that hot Web 2.0. ticket now?

So what? How long do you think "members" need to move to the next "big thing"?

This beacon thing was not only badly thought out and implemented, but Facebook as a company also seems to lie a lot.

Besides that, what about Facebook members in the EU? The sleaze they are trying to pull off is illegal in virtual any EU country (and then some).

They should have done a Google and found themselves a CEO, with respect and a network in the industry. But they seem to have a founder-CEO who doesn't seem to have managed his adolescence quite yet.

Way to go Mark!

Re:Microsoft and $$$

[faraway]

Orwell was a socialist. Communist and socialist are not the same thing.