The hits just keep coming on Facebook’s Beacon advertising program. Beacon not only tracks the activities of Facebook users on partner sites even when they are not logged in, but also reports back to Facebook on activity by non-Facebook users, a Computer Associates security researcher revealed Monday.
In a positive light, Facebook is starting to provide more accurate information about the workings of the program, says Stefan Berteau, a security analyst with Computer Associates.
“If you prevent a certain partner site from publishing stories about you through Beacon, the information about the action is still sent to us,” Facebook told Berteau. “However, if your options are set such that the story won’t be published, we discard that information almost as soon as we receive it.”
Even When Not Logged In
“We hope that they will take steps to mitigate these issues in the near future, because while the statement that this data is not currently being stored or used is reassuring, the fact that the data continues to be sent to facebook.com continues to pose a risk to users’ privacy until a binding, public mechanism is in place to assure that the above policy stays in place, and that users are notified if it ever changes,” Berteau wrote on a CA blog.
On Friday Berteau reported that Beacon alerts Facebook about user activity on partner sites, even when the user is not logged in. “Despite the fact that I was not logged in, Facebook just received enough information to tie the activity I took on their affiliate to my individual account, which combined with the social data they already have, such as circles of friends, level of education, communication patterns, and geographic locations, would allow them to profile individual consumer behavior on a nearly unprecedented level of detail,” Berteau wrote.
In an interview on Monday, Berteau…