2.4k VIEWS
Pinterest LinkedIn LINE

I cannot say this too loudly because I have installed it on this blog too, but I actually find Facebook’s “Like” button rather creepy.

If you visit a site with a Like button while still logged in to Facebook, cookies like the following are sent to Facebook [1].

csm=2;
xs=3:2bPC2V….;
datar=eVE7TanyekLi2UeCWqCdYaUo;
fr=0PBQNPwSEhxk3vCRg.RVUkbgel9qAjCByqVqRQ0lSpntc;
lu=The17FfNt9Yc_hqg8eoWG04B;
s=Ba98fsjdlw-QWvPeofj.BP_Wqm;
c_user=1048138174;
act=134500423456/1:0;
sub=1;
p=16;
presence=EM4fsodmnfkds…;
wd=1195×859;

This c_user is the Facebook user ID. Try going to http://www.facebook.com/1048138174 and my profile should appear. In other words, if I view a page with a “Like” button while still logged in to Facebook, information that I am viewing it is sent to Facebook. It feels rather creepy. Now I understand why a friend of mine, a prominent IT analyst, said that when he uses Facebook he uses only Facebook and always logs out when he is finished.

So Is It Safe If You Are Logged Out?

When you are not logged in, on the other hand, the cookies look like this.

datr=eVE7TanyekLi2UeCWqCdYaUo;
lu=TBpxBfpK4qH–oB0N6yf2SsE;

c_user is gone. I would like to say that all is well, but datr is sent with the same value as before. Trying another site shows that the same datr value is sent there too! [2]

When I accessed it from a different browser, however, datr had a different value. I also found that when I opened a private window, no cookie was initially sent, but after logging in to Facebook once and having a cookie set, a different datr was sent thereafter. Perhaps it is a mechanism for blocking XSRF—that is, tracking the browser session. This does not seem problematic. All’s well that ends well.

Facebook’s Position Is That It “Does Not Track”

So what does Facebook say about this?

According to the Facebook FAQ, if you view a “Like” button while logged in to Facebook, information is sent to Facebook and stored for up to 3 months. (Google stores it for 2 weeks, so this could be considered quite long.) This information is apparently used to display information about what friends have liked and to analyze how websites can attract more traffic. On the other hand, Facebook explicitly states that it does not use the information to show users targeted advertisements on Facebook or to profile them. I quote:

Regardless of whether you are logged in or not, we do not use the information we receive when you visit a site with the “Like” button or another social plugin to create a profile of your browsing behavior on third-party sites to show you ads.

(My translation) Regardless of whether you are logged in, we do not use the information we receive when you visit a third-party site that implements the “Like” button or another social plugin to create a profile of your browsing behavior for the purpose of showing you advertisements.

Although the word tracking is not used here, according to the Geek.com page, Facebook CTO Bret Taylor told the Wall Street Journal, “We don’t use them for tracking and they’re not intended for tracking”.

It somehow seems to me that information going to Facebook when you visit a third-party site fits the definition of being tracked, but apparently the position is that “if it is not used as a matter of policy, it is not tracking.” The same appears to be true of Google’s +1 button, and apparently this is accepted practice in the industry. [3]

From a Site Operator’s Perspective

Well, that may be fine as accepted industry practice, but as a site operator it still concerns me. It seems likely to be illegal in some countries. I would like to obtain proper opt-in consent, but I wonder whether a component for that is available somewhere….

[1] The values have been changed except for c_user and wd.

[2] The value of the other variable, lu, does not change from site to site, but it appears to change continuously over time.

[3] Incidentally, mala’s site explains this area in detail.

 

Related posts

How to Download Photos from Flickr in Bulk

Flickr was acquired by Verizon in 2017. It was subsequently resold to SmugMug, and the service is about to change. Free accounts will be able to…

Identity · 2019-01-07