FYI.

This story is over 5 years old.

Tech

Facebook Admits to Tracking People Who Don't Use Facebook, Blames a Bug

Those rogue cookies? It's just a bug, social network says.
​Image: Jayson Photography/Shutterstock

Facebook has admitted it tracks some non-users—but says it's only a bug and that a fix is underway.

At the end of Mar​ch, Belgian researchers reported that Facebook drops a long-lasting cookie onto your machine, tracking you across pages with its social plugins, even if you've opted into a do-not-track system or aren't a registered user of the site. At the time, Facebook said the report was inaccurate, though it would not say which specific aspects were incorrect.

Advertisement

This week Facebook issued a more detailed response un​der the headline "setting the record straight," with Facebook's vice president of policy in Europe, Richard Allan, saying the Belgian report "gets it wrong multiple times."

However, he does admit that its social plugins add tracking cookies to some people's computers even if they're not Facebook users, one of the central claims of the report, saying it was an unintended "bug."

"Our practice is not to place cookies on the browsers of people who have visited sites with Social Plugins but who have never visited Facebook.com to sign up for an account," Allan said. "The authors identified a few instances when cookies may have been placed, and we began to address those inadvertent cases as soon as they were brought to our attention."

Allan goes on to debunk claims about Facebook—though some aren't actually accusations that were made by the Belgian researchers, from the University of Leuven and Vrije Universiteit Brussels.

For example, Allan suggests the Belgian report claims there's no way to avoid social ads, where advertisers can show images of friends of yours who have liked their products, but—as the Guar​dian points out—the researchers did say it's possible to opt out.

"Facebook's latest press release (entitled "Setting the record straight") attributes statements to us that we simply did not make," the researchers, Brendan Van Alsenoy and Günes Acar, said in a statement sent to me. "We deliberately chose to open up our findings to public scrutiny so that anyone can check our sources and methodology. People who are interested can compare the 'claims' Facebook attributes to our ​report with its actual contents. We still remain open to additional comments and suggestions, including from Facebook, in relation to our actual findings."

Other claims don't address the complaints in the Belgian report. For example, Facebook said it respects do-not-track requests on every device, and points to its support for the the European Interactive Digital Advertising Alliance opt out, which lets you tell websites and advertising networks not to track you for behavioural ads.

However, the researchers said they spotted Facebook placing a long-term cookie when people merely visited the site to opt out. "If people who are not being tracked by Facebook use the 'opt out' mechanism proposed for the EU, Facebook places a long-term, uniquely identifying cookie, which can be used to track them for the next two years," Acar said at the time the report was published.

Facebook didn't address that in its blog post (we've reached out for comment and will update if they respond), but it did point out that the list of debunked claims wasn't "exhaustive." It's an interesting choice of word, as Facebook users are likely starting to feel pretty exhausted by the privacy back and forth.