Hacker News Reader

Comment by downandout | Hacker News Reader

>Facebook tracks virtually every website you visit

Is that true though? Many sites have Facebook share buttons that don’t actually load anything from Facebook unless you use them - they use a locally hosted button (I do this on my own sites, and got the idea from seeing it on so many other sites). I don’t see like buttons (which are directly loaded from Facebook) with anywhere near the frequency I once did either. In fact, the like button is only used on 0.5% of the world’s websites [1]. Even the Facebook pixel, a common target of the scorn of privacy advocates, is only in use on ~12% of the top 1 million sites [2].

12% is hardly “virtually every website you visit”. It’s pretty alarmist to say that.

[1] https://trends.builtwith.com/widgets/Facebook-Like-Button

[2] https://trends.builtwith.com/analytics/Facebook-Pixel

View on HN

> Many sites have Facebook share buttons that don’t actually load anything from Facebook unless you use them - they use a locally hosted button

This is incorrect. "When you load up your site with a host of sharing buttons you're – unwittingly perhaps – enabling those companies to track your visitors, whether they use the buttons and their accompanying social networks or not" [1].

> the Facebook pixel, a common target of the scorn of privacy advocates, is only in use on ~12% of the top 1 million sites

So only tens of millions of people whose browsing history is being siphoned off without their consent?

[1] https://www.wired.com/2013/03/social-sharing-buttons-that-re...

>So only tens of millions of people whose browsing history is being siphoned off without their consent?

If you have an issue with this, disable javascript and third party cookies on your browser - take some personal responsibility. Also, go setup a protest on Google’s front lawn, because Google Analytics (which also tracks you) is in use on nearly 75% of the Quantcast Top 100k sites [1]. That represents billions of people whose “browser history is being siphoned off with their consent” as you put it and over 6x the number of sites that the Facebook pixel is on.

Since you seem to have a significant issue with Facebook, I’d suggest that you block all connections to them, which should solve your problem. Most firewalls, including the free Windows Firewall, enable you to easily block all connections to any root domain. You can configure your firewall to block *.Facebook.com for example, and then you will no longer have to worry about Zuck monitoring you.

[1] https://trends.builtwith.com/analytics/Google-Analytics

> If you have an issue with this, disable javascript and cookies on your browser - take some personal responsibility

This is a problematic attitude. It's the car dealer telling the lemon [1] buyer to "take personal responsibility" for being sold junk.

The point of government is we don't stand alone. Facebook is a menace, and I block them. But I shouldn't have to. And neither should my mother.

> it’s hypocritical to only have a problem with Facebook when Google is doing it on a scale that Facebook can only imagine

Whatabout whatabout [2]? "You can't arrest me because there is another arsonist in town" isn't a valid excuse.

(In any case, third parties calling out some, but not all, bad actors in a category isn't hypocrisy. It's prioritization. Hypocrisy would be Google calling out Facebook's advertising model, or an Enron executive criticising Facebook employees' complicity.)

[1] https://en.wikipedia.org/wiki/Lemon_%28automobile%29

[2] https://en.wikipedia.org/wiki/Whataboutism

I was apparently in the process of editing out the “hypocritical” statement when you replied - I actually didn’t even mean for that to get posted but accidentally hit post before the final post was ready. Anyway I was mainly advising that you block Facebook since you so vehemently dislike them.

> I was mainly advising that you block Facebook since you so vehemently dislike them

Yours is a technical solution to a human problem. If we care about democracy and the future of the Internet, we will dismantle Facebook. (I expect we will, though in typical democratic fashion, after years of quibbling.)

> a human problem.

That's the very crux of the whole "debate" over everything from Facebook to "Russiagate". The bottom line is, you can't fix stupid. We have a very serious problem with stupidity and ignorance in this country. Far too many people lack basic critical thinking skills. You can't childproof society because far too many people are easy to fool. This "problem" won't be fixed until we have a critical mass of people who can think for themselves, be skeptical and aware.

>This is a problematic attitude. It's the car dealer telling the lemon [1] buyer to "take personal responsibility" for being sold junk.

That's a flawed analogy. Paying for a car and being defrauded is in no way related to being tracked by websites. A better analogy is walking around naked and then being upset when people look at your bare ass. If you don't want people to see you naked, wear clothes. If you don't want people to track you on the internet, don't expose yourself.

>The point of government is we don't stand alone. Facebook is a menace, and I block them. But I shouldn't have to. And neither should my mother.

That's not the point of the government. Many of us don't want the government to be an all-encompassing nanny state deciding what's okay for private parties to do with public information. Its incredibly disturbing how many people not only tolerate, but openly welcome government regulation of private, interpersonal behavior. You say they should block Facebook. They have already blocked Backpage. What else do you want to give them the power to block? Where do you draw the line? Personally I think Facebook is extremely scummy. I'm not on Facebook, and I block them in every way - but I certainly don't want the government blocking them - or anyone else - on my behalf.

There's an old saying "when you owe the bank a million dollars it's your problem, when you owe the bank billion dollars it's their problem" (like I said it's an old saying ;-)

I think there's an analogy here-if enough people are being successfully abused by private companies it's no longer a matter that you can just pawn off on some sort of concept of personal responsibility. If your beloved private companies are threatening to exploit people hard enough to threaten the very existence of democracy, then it certainly starts to look like something where exploring a government role is worthwhile.

> Paying for a car and being defrauded is in no way related to being tracked by websites.

This is incorrect: they're both examples of informational asymmetry being used to disadvantage a consumer. In both cases, that consumer needs to possess technical knowledge in order to understand the ways that the counterparty entity is exploiting them. In the case of the car dealership, at least the consumer is aware of the stakes when they step onto the lot, i.e. they are planning to buy a car. The problem with Facebook is exactly that people aren't aware of how they are being monetized, and that there is an explicit financial incentive to obscure that from them. They are stepping onto a car lot, or more accurately a surveillance operation, that has been made to look like an amusement park. "Personal responsibility" is a convenient fig leaf for people who want to pretend that the amusement park wasn't the sales pitch. If you don't like the original analogy to a used car salesman, consider the need for similar regulation around financial services, clean water, pharmaceuticals, etc. etc. etc.

Yeah, the situation here is more akin to you go outside wearing clothes, but they've developed x-ray glasses and you're now like, "What? Just wear a lead apron everywhere you go".

Does GA share data outside of GA? Last I looked into it, I came away thinking that data is kept to privacy standards equivalent to e.g. Google Sheets.

It appears that they do. From [1]:

When you visit a website that uses our advertising products (like AdSense), social products (like the +1 button), or analytics tools (Google Analytics), your web browser automatically sends certain information to Google....we may use the information we receive to, for example:

Make ads more effective....

[1] https://policies.google.com/privacy/partners

In this case, the "may" part in there is relevant, and not just an attempt to add in ambiguity to defuse things.

The Google Analytics property owner has to explicitly opt-in to allow Google to do this. And part of that opt in includes the site owner agreeing to an addition ToS certifying that they both disclose they do so and have appropriate consent to do so. You can learn more about that at [1].

In practice, most site owners toggle this feature on without realizing the liability they've agreed to. Because it enables additional reports in GA (by merging and exposing the demographic targeting data their ad system has), as well as pushes GA data into Adwords and DoubleClick if you want to link your accounts. But, Google does keep the GA data siloed off by default.

[1] https://support.google.com/analytics/answer/2444872?hl=en

But the end result is that most GA widgets are reporting data that is being used by Google to improve ad targeting, since most site owners turn the feature on.

[citation required] but even if true, getting site owners to opt-in to exchanging their user's privacy for psychographic and demographic correlations seems materially different than Facebook's "no opt out" on a relatively unrelated feature like a Like button on a 3rd party site. They used to and could again make the button work without using it to gather browsing data.

> If you have an issue with this, disable javascript and third party cookies on your browser - take some personal responsibility.

I tried and doing so breaks pretty much every website. Because it’s not only the tracking stuff that makes use of JavaScript and third-party cookies.

Ignore him. This is one of the classic responses to any challenge of the status quo. If you don’t like the way things are then you should upend your entire life, go live in a cave, subsist on bugs and stop challenging my world view.

Tl;dr He was trying to sound helpful while telling you to go fuck yourself.

I was doing no such thing. I was simply telling him the only realistic way to cut down on third-party tracking.

It may, but unfortunately you have limited choices. You can also browse in an incognito window, which will at least disable tracking from session to session. However, even then your IP address is being associated with certain behaviors.

The reality is that you have a choice: use the Internet and have some tracking happen, or don't use it at all. Even the GDPR doesn't stop tracking - it just requires better disclosure of it and mandates certain handling procedures for the data that is collected on the backend.

If you just have a dislike for certain websites tracking you, you can use the Windows (or other) firewall to block specific domains as I stated above.

Firefox has support for multiple profiles! I have a profile that I only use for Facebook, Gmail, and Twitter, and one that I use for everything else. Probably not perfect, but provides more isolation.

I beg to disagree. GDPR doesnt stop the tracking but forces the one doing the tracking to get your opt-in, FREELY given consent for each and every use of private data. And if you require consent, this is then not freely given and in such case invalid (forget about trackwalls).

(I am not talking about criminals here, they wont care)

Effectively this means that if user doesnt want to be tracked you wont track it. And that you cant load facebook button on your page if you dont get consent (or you are liable for lawsuit, by user and, the more interesting part, by facebook as you are providing them with illegal data.

Please read this, you are taking GDPR much too shallow... it is not and quite a few companies will have problems as they were too lazy to read the GDPR but were rather relying on messed up opinions on the internet.

https://www.youtube.com/watch?v=-stjktAu-7k

Using uBlock Origin, uMatrix, or NoScript gets you very far in this regard. You don't need to whitelist that many scripts on each site before they start functioning.

Google is awful. But so is Facebook. Shifting blame to Google in a discussion about Facebook is a distraction from the problem.

When someone pipes up saying how terrible it is that one company is tracking people on 12% of the top websites in the world, I think it's directly relevant to point out that another one is tracking people on 75% of that same group of sites. The tracking is either an issue or it isn't, regardless of who is doing it. If it isn't, then this is a pointless discussion, and if it is, then clearly this particular discussion should primarily be about Google.

Regardless, it is a moot point because third party tracking is here to stay, even under GDPR - you'll just have another message box to dismiss when browsing. My favorite so far is this one - http://prntscr.com/j67usw . I offered a few ways to slow down that tracking above, but the only true way to not be tracked is to not use the Internet, because none of this even broaches the subject of what data ISPs collect about your behavior.

I can appreciate that argument, and I agree with you, but I don't think that's the argument you made in your original comment. It's a good one, though.

> If you have an issue with this, disable javascript

I have an issue with Facebook doing this to OTHER PEOPLE and thus dramatically influencing the world I live in. I can and do block their Javascript, but that doesn't block it for others.

The idea that our decisions are just independent and everyone can decide for themselves is (A) wrong in terms of how we are affected by decisions made by others (B) anti-social and (C) denies the reality of organized power.

If Facebook had to just be a bunch of unorganized, separate, independent people instead of a company with organized structure, they'd not have the power they have. They have power because of their organized structure. The idea that the other side of thing (the regular citizens) should only act as isolated individuals while the companies act as enormous organized power is ridiculous.

If it has so much influence, then it must be controlled by more powerful superiors than just that Zuck guy, isn’t it. He must be thankful for they to leave him a possibility to sell t-shirts.

That sounds like a tautology along the lines of Creationist thinking (this is so well-designed, it must have a designer…)

If there are more powerful superiors, then wouldn't the same argument apply? They must be powerful because they have superiors, etc. etc. ad absurdem…

My point wasn't that any ONE person (Zuck or anyone) is all powerful or influential. The point is that SOLIDARITY i.e. ORGANIZATION itself confers power on the organization.

Organized power might be distributed where no one person can dictate the organization's direction. Or it might have an all-powerful-dictator. Either way, organizing confers power to the organized entity.

Corporations are powerful, even though they are constrained in various ways and the power is wielded by a mix of actors within the corporation.

Consumers / citizens who each act unilaterally have less power even though their aggregate decisions can have powerful effects in the market (because they are disorganized, they can only choose from what the supply side offers, we don't get true demand-driven products).

Organized power doesn't necessarily mean top-down either. See the Starfish and the Spider (book about decentralization). Decentralized entities are more persistent (no single head to cut off to kill them), but decentralized ≠ unorganized.

2003 called and wants it HTML back. Seriously, the web today with JavaScript disabled?

Grandma configuring her what now?

75% of 100,000 is 75,000

12% of 1,000,000 is 120,000.

Not advocating for one side or the other, just correcting the math.

One person commented on 12% of top 1m sites. Another is commenting on 75% of top 100k sites.

EDIT: Checked the source material links and GA is on 65% of the top 1m. That is definitely more, and a more useful comparison I think.

> So only tens of millions of people whose browsing history is being siphoned off without their consent?

Tens of millions of people are asking Facebook for the Share button in case they want to share the content they're looking at.

Fixed that for you.

I have not yet met any person who has used, or wanted to ever use the share button of any of the tracking companies. On the other hand, I have met a lot of people who have no idea what that button does to their privacy.

Only the soul-less marketing drones without any sense of morality, ethics or empathy for others are asking for the share buttons, even if the only party profiting from them are the tracking companies.

This is incorrect

And yet this is precisely what I do on my sites, and I have seen it done this way on many, many other sites as well.

How does Facebook track visitors with a locally hosted button?

I think a lot of people dont realise you can share to Facebook with a standard link and don't need their javascript.

How you can do it "unwittingly"? If you put a button on your site that says "like us on Facebook" or "analytics by Facebook", how can't you realize you're inviting Facebook into your relationship with your site's visitors, and you do it completely voluntary, expecting to gain more exposure, better marketing tools, etc. ?

"When you load up your site with a host of sharing buttons you're – unwittingly perhaps – enabling those companies to track your visitors, whether they use the buttons and their accompanying social networks or not" [1]."

This can be prevented and in fact, may have to be prevented with the new EU privacy law.

Here is a wordpress plug-in that helps to protect the privacy of your users and helps comply with the new law:

https://de.wordpress.org/plugins/shariff-sharing/

It basically requires you to activate the social buttons first with a click.

I'd like to see traffic distribution against the sites which use facebook. I suspect your p90 for all traffic is against a large proportion of sites that use these and thus "virtually" every site in fact is closer to true than your raw numbers.

Well that’s a bit of a self-fulfilling prophecy. Most sites that pay to advertise on Facebook are going to use the pixel for retargeting and conversion tracking. But only 25% of the Quantcast Top 10k sites use the pixel, and the number for the whole Internet is 0.4%.

I wouldn’t say that anywhere near most of my browsing originates from Facebook ads...in fact I’m not entirely sure I have ever clicked on one except to view competitors’ landing pages. I’m guessing that most other people don’t limit the sites they visit to those they are shown in paid Facebook ads either. So the overall numbers are extremely relevant.

You missed my point. I’m suggesting that the 75th percentile of traffic goes to sites that probably have Facebook integrated via like button, ads, auth. (Way that fb can track you.)

Therefore most traffic on internet is traceable. Key being traffic not count of sites in my analysis.

Well, that's what the Quantcast numbers are for...the top 10K sites are the top 10K trafficked sites in the world. And only about 25% of them have the Facebook Pixel.

Pixel isn't the only way to embed Facebook on the page mate. Facebook plugins and facebook auth also.

I went through the stats for those above as well. I used the Pixel because it's by far more prevalent than any other Facebook-hosted stuff (plugins etc).

Here are some numbers [1]:

> Over the last week ... the Like button appeared on 8.4M websites covering 2.6B webpages, the Share button on 931K websites covering 275M webpages, and there were 2.2M Facebook pixels installed on websites

[1] https://twitter.com/facebook/status/985999292862152708

Yes, but that 8.4M websites is out of a universe of ~375 million websites - so it's a very small percentage (I am using the number of sites that BuiltWith tracks, which probably isn't all websites, but it's a minimum number). The pages number is meaningless, because sites that use it will use it on every page they have - if I have a site with 2 million auto-generated pages, then I account for 2 million of those web pages.

You won't see the locally hosted button suggested on Facebook's website, so it's far less common than the tracking version.

12% of websites can still reveal a lot about you - a few news sites and they'll know your political leaning and topics of interest. A recipe site and they could deduce your race. A lyrics site can indicate your gender, race and age. Etc.

If the denominator of that 12% number includes adult websites, which presumably know you don’t want to share to facebook, then this number may mean something a little different than many will assume it does

Reply on news.ycombinator.com