They have a point. This is going to be the same for any site that has static content served elsewhere with cookies attached to the domain. Hot link to an image on my blog you commented on? OFFLINE DATA GATHERING ZOMG.
They don't really want to.
(I work at Facebook, but not on this.)
However, if one of the problems that they wanted to solve was 'we dont want to track user data unless they are logged in', they would have solved it by now.
The fact that they haven't means either (a) they just haven't thought about it or (b) they have thought about it, but do not want to solve it.
To do this, it needs to know who you are if you are a Facebook user that has not logged out. To do that, it needs to check the cookie that the Facebook web site sets when you are logged in.
Unfortunately, the web as it stands doesn't allow this interaction without divulging some information (time/date, browser, IP address, &c.) when the only interesting thing is who you are if you happen to be logged in.
This is the same problem that web analytics, certain comment systems, other social buttons, and other embedded functionality systems face.
About the best that can be done is explain what happens with that data when it is received - and that is explained at https://www.facebook.com/help/?faq=186325668085084
The browser manages this - if they are logged in, set a cookie that will be sent to the hypothetical 'like' subdomain of facebook, if they are logged out, remove the cookie.
This kind of functionality is really not rocket science, there are dozens of ways to implement it and I feel kind of stupid talking about it.
There are reasons for facebook not doing this, but they are not technical ones.
Thanks to both of you!
not that third-party cookies aren't a big privacy issue, but this goes one step further.