Serious Privacy Issues With Facebook’s Beacon

December 1st, 2007

Technology Last week, the news of Facebook moving back to “opt in” for their Beacon advertising plan was all over the tech blogosphere. I found myself in complete agreement with Adam Green of Moveon.org:

Facebook should explain why they chose at the last minute to put the wish lists of corporate advertisers ahead of the privacy interests of their users.

That sums it up from my perspective. But now a bombshell: Recently new research has shown that even if you opt out of Beacon - information is still being sent from affiliated sites you visit to Facebook.

Read the article carefully and consider what it implies for your own browsing habits. I’m taking it as a huge sign to stop using Facebook until I get a definitive word one way or another. The method used is downright deceptive.

Essentially, when I log out of a website I expect tracking to be over. Completely. Even MyBlogLog, which tracks my presence over multiple sites, is a known quantity in that when I delete all cookies, the tracking ceases. I have control.

What the article implies is that if you land on an affiliate site after logging into Facebook, and you previously used the “remember me” option on Facebook - you’ll receive a new Facebook cookie from the affiliate site. You should be prompted to “opt out” on the new site, but even if you do - the data is sent regardless.

“Opt out” therefore implies that Facebook isn’t retaining or using that data… but how can one be sure? Especially when Zuckerberg himself believes “There is no opting out of advertising”.

Here are some helpful tips from the article on how to get around this situation:

How can this transfer of data be prevented? The blocking method from Ben’s blog will continue to be effective against Beacon, whether you are logged on to Facebook or not. In addition, deleting your facebook.com cookies and avoiding the “remember me” option when logging in will keep Facebook from being able to track you while not logged in. Your data will still be sent if you are logged in to Facebook, however, regardless of the choice you make when presented with the opt-out dialog.

Also if you use Firefox, you can install a plug-in that blocks Beacon:

I tried out Firefox’s BlockSite Plugin and it works great (if you use Firefox). Just download the plugin and add http://www.facebook.com/beacon/* and facebook.com/beacon/* under ‘options’ to the ‘add’ section and restart your browser.

And lastly, here’s a reported list of companies that are currently participating in Beacon. I found this in a comment at the bottom of a New York Times article. Another list is at binaryFreedom, or this one from Facebook themselves. Anecdotal evidence - I can confirm Blockbuster and Yelp.

Blockbuster, Chase, The Coca-Cola Company (They are waiting and seeing), Verizon, Epicurious.com, Flip.com, Crest Whitestrips (whitestrips.com) Owned by Proctor and Gamble, Dove Cream Oils (Dove.com) Unilever Company, Herbal Essences (herbalessences.com) Clairol Division owed by Proctor and Gamble, NYTIMES.COM, Saturn, AllPosters.com, Bluefly.com, CBSSports.com, Dotspotter, ExpoTV, Gamefly, Hotwire, Joost, Kiva, Kongregate, LiveJournal, Live Nation, Mercantila, National Basketball Association, Overstock.com, (RED) joinred.com, Redlight (stay away from adult sites any one of them can be this redlight company and be telling your friends about your sex fetishes. Yuck!), SeamlessWeb, Sony Online Entertainment LLC (station.com), Sony Pictures, STA Travel (statravel.com), The Knot, TripAdvisor, Travel Ticker, TypePad, viagogo, Vox, Yelp, WeddingChannel.com, Zappos.com, ebay, bluefly.com, Travelocity, echomusic, pronto.com, citysearch, Iwon, Busted Tees, College Humor (same company as busted tees), Fandango

(list compiled by coolrepublica)

Coke is reconsidering participation due to the Beacon fall-out. I expect others to follow suit. In the meantime, use all of the above companies’ websites at your own risk. Some public shaming is in order.

I post this information because there’s a lesson to be learned about disclosure - and who is ultimately more important, users or the advertisers? I firmly believe the best companies put their users first, and any startup that relies on user created content or community - you owe us big time.

At this point, I feel the lofty valuation of Facebook is definitely somewhat tainted. The mind reels: did Google get a preview of this Beacon stuff, feel it was too creepy - and therefore let Microsoft take the bait? That could go down as the most brilliant business move of 2007.

Update (12/5/07): Facebook has relented and is moving to make Beacon “opt in” and give people the ability to block affiliate sites’ communication. Yay.

Additional Reading: Dare Obasanjo, Computerworld, WebGuild

Please subscribe to the Webomatica RSS Feed!