Comment by y0ghur7_xxx | Hacker News Reader

Comment by y0ghur7_xxx | Hacker News Reader

Parent Full thread

> all of this data is standard stuff that every browser

> sends to every server of any site on every request.

Come on lbrandy, let's be honest. Are you telling me and to the HN audience that you don't use the data "that every browser sends to every server", analyze it, try to get unique users out of it, try to gather interest, browsing behavior, a lot of other stuff and sell it to advertisers? Because that would contradict what you state in your privacy policy.

>> If that's not "tracking" I don't know what is...

> I believe the word I'd use is "http".

http is the protocol you gather the data with. Once you got it, you gather your stats from it. And thus track users with it. And you state so explicitly in your privacy policy. And there is IMHO nothing wrong with it. I adblock it anyway.

> Are you telling me and to the HN audience that you don't use the data "that every browser sends to every server", analyze it, try to get unique users out of it, try to gather interest, browsing behavior, a lot of other stuff and sell it to advertisers?

That's pretty much the definition of "cookieless tracking", isn't it? Feel free to read my original post.

This is spelled out quite clearly here: https://www.facebook.com/help/?faq=186325668085084

> That's pretty much the definition of "cookieless tracking", isn't it?

Yes, it is.

"We will keep aggregated and anonymized data (not associated with specific users) [...]"

Ok. So you partially confirm my point. You DO track users. But you say you don't keep the information associated with "y0ghur7_xxx", but with user_id:389472984. At least on the FAQ. The privacy policy is not so clear.

user_id:389472984 isn't anonymized. Aggregated and anonymized data means, "gender:male ages:18-34"

lbrandy has it right here. If your definition of "tracking" is "web server log analysis," then nearly every web site you visit is tracking you.

It's really nothing to worry about though, unless Facebook is doing something to de-anonymize that (otherwise stateless) data. They could probably do that (by noting the IP and User-agent seen when logging out, for example), but they explicitly claim not to in a number of places, most recently by lbrandy in this thread.

> lbrandy has it right here. If your definition of

> "tracking" is "web server log analysis," then nearly every

> web site you visit is tracking you.

Of course. The "problem" is that the FB widget is all over the web, giving them the the possibility to track users not only on a single page, but on (almost) the whole web. I put "problem" in quotes because it's only really a problem if users don't know that. And I think the vast majority of FB users don't know that FB knows almost every page they visit on the web. The same is true for google as well of course.

At prior jobs we would put similar language in our privacy policy, not because we did anything with the data, but because we didn't want someone to claim we violated the policy due to how web browsers worked. Either you trust Facebook to follow their privacy policy or you don't; short of auditing them there is now way to validate otherwise.

If you are really concerned about this why not use a browser extension that randomizes your HTTP headers?

Reply on news.ycombinator.com