Comment by y0ghur7_xxx | Hacker News Reader

Comment by y0ghur7_xxx | Hacker News Reader

Parent Full thread

So you don't track users with the "like" widgets? Even when they don't click on them? That would contraddict everything I read from FB until now.

> I suppose you guys can line up to say I'm lying

I never sad you lied. I just sad what you explicitly state on your privacy policy:

"We receive data whenever you visit a game, application, or website that uses Facebook Platform or visit a site with a Facebook feature (such as a social plugin). This may include the date and time you visit the site; the web address, or URL, you're on; technical information about the IP address, browser and the operating system you use; and, if you are logged in to Facebook, your User ID."

http://www.facebook.com/about/privacy/your-info#inforeceived

If that's not "tracking" I don't know what is...

> This may include the date and time you visit the site; the web address, or URL, you're on; technical information about the IP address, browser and the operating system you use; and, if you are logged in to Facebook, your User ID."

With the exception the the UserID for logged in users, all of this data is standard stuff that every browser sends to every server of any site on every request.

> If that's not "tracking" I don't know what is...

If basic http header stuff is "tracking" to you, then every site on the internet is tracking you.

> all of this data is standard stuff that every browser

> sends to every server of any site on every request.

Come on lbrandy, let's be honest. Are you telling me and to the HN audience that you don't use the data "that every browser sends to every server", analyze it, try to get unique users out of it, try to gather interest, browsing behavior, a lot of other stuff and sell it to advertisers? Because that would contradict what you state in your privacy policy.

>> If that's not "tracking" I don't know what is...

> I believe the word I'd use is "http".

http is the protocol you gather the data with. Once you got it, you gather your stats from it. And thus track users with it. And you state so explicitly in your privacy policy. And there is IMHO nothing wrong with it. I adblock it anyway.

> Are you telling me and to the HN audience that you don't use the data "that every browser sends to every server", analyze it, try to get unique users out of it, try to gather interest, browsing behavior, a lot of other stuff and sell it to advertisers?

That's pretty much the definition of "cookieless tracking", isn't it? Feel free to read my original post.

This is spelled out quite clearly here: https://www.facebook.com/help/?faq=186325668085084

> That's pretty much the definition of "cookieless tracking", isn't it?

Yes, it is.

"We will keep aggregated and anonymized data (not associated with specific users) [...]"

Ok. So you partially confirm my point. You DO track users. But you say you don't keep the information associated with "y0ghur7_xxx", but with user_id:389472984. At least on the FAQ. The privacy policy is not so clear.

user_id:389472984 isn't anonymized. Aggregated and anonymized data means, "gender:male ages:18-34"

lbrandy has it right here. If your definition of "tracking" is "web server log analysis," then nearly every web site you visit is tracking you.

It's really nothing to worry about though, unless Facebook is doing something to de-anonymize that (otherwise stateless) data. They could probably do that (by noting the IP and User-agent seen when logging out, for example), but they explicitly claim not to in a number of places, most recently by lbrandy in this thread.

> lbrandy has it right here. If your definition of

> "tracking" is "web server log analysis," then nearly every

> web site you visit is tracking you.

Of course. The "problem" is that the FB widget is all over the web, giving them the the possibility to track users not only on a single page, but on (almost) the whole web. I put "problem" in quotes because it's only really a problem if users don't know that. And I think the vast majority of FB users don't know that FB knows almost every page they visit on the web. The same is true for google as well of course.

At prior jobs we would put similar language in our privacy policy, not because we did anything with the data, but because we didn't want someone to claim we violated the policy due to how web browsers worked. Either you trust Facebook to follow their privacy policy or you don't; short of auditing them there is now way to validate otherwise.

If you are really concerned about this why not use a browser extension that randomizes your HTTP headers?

The issue isn't that I'm tracked when I visit Facebook - that's normal. The issue is that I am (at least potentially) tracked when I don't visit Facebook due to your ubiquitous Like button.

That's the privacy-endangering activity that has resulted from your sheer size. Please don't pretend it doesn't exist.

The issue is that I am (at least potentially) tracked when I don't visit Facebook due to your ubiquitous Like button.

That's no different from being tracked by Google(DoubleClick). If you don't approve, it's really a matter between you and the web sites you visit.

But it is different from what a single site can do. Why do you muddy the issue? Was Google under discussion? No. So why turn this into a tribal identification game?

I was looking at it is a technical issue, not a tribal identification game. Any third-party that embeds stuff on any of the web sites that you visit has a capability of tracking you in some capacity.

That's a simple fact that sometimes gets lost when people are discussing Facebook. Lots of third-parties do this sort of thing and most of the time, nobody notices or cares. It feels odd to hold Facebook to a different standard.

That particular sentence does not describe "tracking", it describes "http". Those are just the data every browser sends to a server if it requests a resource hosted there. The sentence you cited is just a description of the behaviour of the protocol. Tracking only happens if the server logs these data, which it may or may not do, and the rest of the facebook privacy policy seems to say that they indeed want to do that, or at least keep the option to do so. But no matter what the server operator says it does, you cannot really check that.

Reply on news.ycombinator.com