Report: Facebook Tracks Visitors Who Have Opted Out, Violating EU Law

itwbennett writes: In a technical analysis (PDF) of Facebook's tracking practices, researchers found that Facebook tracks everyone who visits its site, including people who don't have an account, and even continues to track users and non-users who have opted out of targeted ads. The problem with these practices is that the cookies are placed without consent, which under EU law is only allowed if there is a strict necessity to do so. Facebook disputes the report: "We have explained in detail the inaccuracies in the earlier draft report (after it was published) directly to the Belgian DPA, who we understand commissioned it, and have offered to meet with them to explain why it is incorrect, but they have declined to meet or engage with us."

Comments

Standard Operating Procedure

[Fire_Wraith]

This is pretty much how Facebook operates. They don't just suck in all the information of people who use their service, they collect information on everyone else. Even if you don't use Facebook, they've built a 'shadow' profile on you using information they've gotten from your friends and family. They're certainly not the only one that does so, but they're one of the most pervasive (at least in my opinion).

It's also why it's important to use something like Ghostery, to block the methods they're using to track people. Bottom line, if you don't see the Facebook "like" button load, you've got them blocked.

Here in America

[rsilvergun]

we have an understanding. We write laws to protect consumers and nobody enforces them. Did nobody in Europe get the memo? Where's Thatcher when you need her...

Re:Here in America

[Anonymous Coward]

Long since underground. Which is where we needed her decades ago.

they also....

[Anonymous Coward]

Facebook tracks everyone who visits its site, including people who don't have an account, and even continues to track users and non-users who have opted out of targeted ads.

they also track everybody that visits a 3rd party site with facebook code (like button, shared login, etc) on it.. and they're tracking everybody playing a game that hooks into facebook api's.. even if that game isn't actually hosted on facebook and the player isn't signed in through it.

Call me a cynic

[Carewolf]

But I would trust independent researchers over facebook any day, and especially when it comes to issues concerning possibly bad behavior by facebook.

la la la isn't it ironic

[Bender Unit 22]

That you need a cookie so that Facebook can remember that you don't want to be tracked.

Of course that cookie could contain a single non-unique value that states, do not track me.
But of course that Facebook doesn't really care about privacy can't come as a surprise to anyone.

Facebook "offered to explain why it is incorrect"

[penguinoid]

Pretty funny that anyone would care about Facebook's "explanation" about why the independent researchers finding all those tracking cookies are all mistaken... but to be honest, I'm pretty sure that killing off Facebook's tracking wouldn't do anything if everyone else is tracking you anyhow.

This is why I block them at the host file

[Anonymous Coward]

# Facebook
127.0.0.1 www.facebook.com
127.0.0.1 facebook.com
127.0.0.1 www.static.ak.fbcdn.net
127.0.0.1 static.ak.fbcdn.net
127.0.0.1 www.login.facebook.com
127.0.0.1 login.facebook.com
127.0.0.1 www.fbcdn.net
127.0.0.1 fbcdn.net
127.0.0.1 www.fbcdn.com
127.0.0.1 fbcdn.com
127.0.0.1 www.static.ak.connect.facebook.com
127.0.0.1 static.ak.connect.facebook.com
127.0.0.1 aps.facebook.com
127.0.0.1 www.connect.facebook.net
127.0.0.1 connect.facebook.net

Facebook can be useful if you have this problem:

[Futurepower(R)]

Facebook can be useful if you have this problem: Are you too happy? Is it uncomfortable being happier than everyone else? Do you want to be miserable like everyone you see around you? Facebook has an answer. Read Facebook use predicts declines in happiness, new study finds. Or download the scientific paper.

How to avoid the abusers:
Adblock Edge
NoScript
Ghostery
Better Privacy
Cookies Manager Plus (Does not delete one particular Google cookie.)

Facebook gets a list of all websites visited.

[Futurepower(R)]

Jurgen Schmidt of Heise Security says: "Since Facebook buttons are virtually omnipresent, Facebook can get a complete list of all the websites that I visit and link it to my person..."

Facebook Blocker

Re:Facebook "offered to explain why it is incorrec

[MrL0G1C]

So block them all. Ghostery - Download Page

Google are the worst IMO.

Bullshit non-story

[IamTheRealMike]

OK, so we have an article claiming Facebook is tracking everyone for evil advertising purposes, even when logged out. Facebook denies it and says it's garbage.

Let's go do 30 seconds of digging and see who is right, shall we?

1. Open an incognito window. Open Chrome developer tools.
2. Load a Facebook "page" (i.e. a product page for some third party product or service)
3. Be amused by the giant "STOP!" warning printed to the console, apparently people are being tricked into copy/pasting stuff into the developer console to get their accounts hacked.
4. Observe the cookies that are set.

There are three cookies set. Two of them appear to simply encode the loaded URL and have no ids or other interesting info. The last is the "DATR" cookie. What does DATR do? Well, we know what it does because last time this garbage blew up in the press Facebook explained what it does:

We set the ‘datr’ cookie when a web browser accesses facebook.com (except social plugin iframes), and the cookie helps us identify suspicious login activity and keep users safe. For instance, we use it to flag questionable activity like failed login attempts and attempts to create multiple spam accounts.

(link from here)

So it's an anti abuse and security feature. Nothing to do with advertising. Also, guess what - such cookies are common across many websites. They are quite useful for detecting spammers. Presumably Facebook tried to explain this to the Belgian regulator in question, but it's just so much better politically for said regulator to pretend they caught some evil company in their terrible advertising habits red handed, than learn how large websites work.

The problem is the more time the media and government regulators cry wolf over this stuff, the more inclined I am to believe they're all harmful idiots who want to break the web.

Re:Bullshit non-story

[Ol Olsoc]

The problem is the more time the media and government regulators cry wolf over this stuff, the more inclined I am to believe they're all harmful idiots who want to break the web.

Very nice, and concise.

But most very whooshable. Now try your method on any page that has a facebook button or for that matter most any popular page that the facebook crowd goes to. Check out the scripts while you are at it.

Facebook is simply tracking everyone. No account needed. No opt-in or out needed.