[Infowarrior] - Facebook tracks all visitors, even if you’re not a user and opted out

[Richard Forno]

Report: Facebook tracks all visitors, even if you’re not a user and opted out

In the EU, where free and informed prior consent is required, there could be an issue.

by Glyn Moody - Mar 31, 2015 2:10pm EDT

http://arstechnica.com/tech-policy/2015/03/report-facebook-tracks-all-visitors-even-if-youre-not-a-user-and-opted-out/

Facebook tracks the Web-browsing activities of all visitors to the facebook.com domain even if they are not a Facebook user, according to new research from Europe. The report (PDF) updates work from earlier this year, which found that Facebook's updated privacy policy breached EU law.

The research has been commissioned by the Belgian data protection agency, which is investigating Facebook. It was a collaboration between the Interdisciplinary Centre for Law and ICT/Centre for Intellectual Property Rights (ICRI/CIR) at the University of Leuven and the Department of Studies on Media, Information, and Telecommunication (SMIT) of the Vrije Universiteit Brussels.

This newly found tracking, used to provide targeted advertising, is carried out through Facebook's social widget, the Like Button. A cookie is placed in the browser when someone visits any page in the facebook.com domain, including sections that do not require an account. For visitors that are not Facebook users, the cookie contains a unique identifier, and it has an expiration date of two years. Facebook users receive additional cookies that identify them uniquely. Once those cookies have been set, Facebook will receive them for every subsequent visit to a website that uses Facebook's social widget. That applies whether or not the Facebook user is logged in to his or her account and whether or not the visitor to the third-party site actually uses the social widget.

The researchers suggest "collection or use of device information envisaged by the 2015 [Facebook Data Use Policy] does not comply with the requirements of article 5(3) of the [European Union's] e-Privacy Directive, which requires free and informed prior consent before storing or accessing information on an individual’s device." The problem is that users are not told enough about what information is being collected and how it is being used. Moreover, the authors of the report say: "Facebook also tracks non-users in a manner which violates article 5(3) of the e-Privacy Directive."

The researchers went on to investigate to what extent Facebook's opt-out mechanism allowed people to avoid this tracking. They found that when a Facebook user opts out, Facebook promises to stop collecting browsing information, or use it only specifically for the purpose of showing advertisements. The site continues to track its users when they visit a webpage containing a Facebook social widget even after the user opts out.

The situation for visitors who are not Facebook users is even worse, according to the report. During the opt-out process, Facebook sets a long-term identifying cookie and then uses this to track visits to pages that have a Facebook social widget. In other words: "for those individuals who are not being tracked by Facebook (e.g. non-users who have never visited a page on the facebook.com domain, or Facebook users who clear their cookies after logging out from Facebook), using the 'opt out' mechanism proposed for the EU actually enables tracking by Facebook" (emphasis in original). Given that this behavior is likely to fall foul of EU privacy laws, it's curious that Facebook does this in the EU but does not place a long-term identifying cookie when people visit opt-out sites for US and Canadian users, according to the researchers.

These results will presumably form the basis of the report for the Belgian data protection agency, which means that Facebook may be required to explain why it seems to be breaching European data protection laws in multiple ways. According to information on the new report's webpage, the Belgian data protection commission "is also part of a European task force, which includes data protection authorities from the Netherlands, Belgium, and Germany. ICRI/CIR and iMinds-SMIT will continue to support the [Belgian] Privacy Commission in the context of its investigation and future updates to the report will also be shared with their German and Dutch colleagues." Facebook may therefore be investigated by data protection authorities in those countries, too.

As if that weren't enough, Facebook must also worry about the outcome of the important case currently before the Court of Justice of the European Union, which hinges on whether the data protection it offers to users in the EU is "adequate." The new research results, if confirmed, are hardly going to help.

--
It's better to burn out than fade away.