Facebook, Here is Misinformation

Update

I have received a response from Facebook’s Vice President of product marketing and operations, Chamath Palihapitiya, in the comments which I then verified over email: Hi The comment in question above was a miscommunication. I was speaking specifically to if data is STORED when someone clicks “No, Thanks”. We have contacted the NYT to clear this up but are still waiting for an update to be posted. Please find a complete explanation below. When a Facebook user takes a Beacon-enabled action on a participating site, information is sent to Facebook in order for Facebook to operate Beacon technologically. If a Facebook user clicks “No, thanks” on the partner site notification, Facebook does not use the data and deletes it from its servers. Separately, before Facebook can determine whether the user is logged in, some data may be transferred from the participating site to Facebook. In those cases, Facebook does not associate the information with any individual user account, and deletes the data as well. I responded: Chamath, Thanks for your quick response. I have posted your comments on my blog. That information is good news. However, as much as I appreciate you personally responding, the policy you described isn’t mentioned in the Beacon FAQ or your privacy policy. I am not questioning your honesty, but considering the general hysteria that people have had in the last two weeks over Beacon I would think they might want more than your comment on a blog as random as my own. I would suggest that you to include this information in your FAQ as well as your privacy policy. This way people (who as you know are very skeptical of Facebook this week) will know how you handle their data and feel that Facebook could be held responsible if ever it was discovered they deceived them. Again thanks for your response, it’s good to know you are taking active initiative to resolve this issues. Nate He replied again: Thank you - this is good feedback. I am surprised the FAQ, at a minimum, hasn’t been updated with this new information so we’ll get on this. Feel free to ping me directly if you ever have issues with us and want direct feedback going forward. We want to hear it and I am available to listen… Thanks, Chamath and again: Nate - we just updated our FAQ. Please see it here below: www.facebook.com/help.php?page=57 It is the 6th Question+Answer from the top. I would appreciate if you could update your blog and possibly link to this FAQ if you thought it was appropriate. Again, thanks for the feedback. Chamath So that’s the official word from Facebook. They do receive the data, but they are not storing it when you select ‘No Thanks’. I am sure the debate will continue over Beacon, but at least they’ve made an official stance on the matter.

Original Post

Today Facebook announced new updates to Facebook Beacon, which you can read about here. However, the thing that struck me most was an answer from an interview by the New York Times with Facebook’s Chamath Palihapitiya, vice president of product marketing and operations at Facebook. Q. If I buy tickets on Fandango, and decline to publish the purchase to my friends on Facebook, does Facebook still receive the information about my purchase? A. “Absolutely not. One of the things we are still trying to do is dispel a lot of misinformation that is being propagated unnecessarily.” Now that… is not exactly true. And I tested it this morning.Using the Firefox Plugin, FireBug, you are able to look at all of the requests that your browser makes. It also shows you the data and response that is sent along with each request. So I went back onto Kongregate (sorry Jim), and opened up a game. After a few minutes the Facebook Toast popped-up (This is the little window that appears in the corner) letting me know it was sending the data to Facebook. I clicked ‘No Thanks’. So, by all means I ‘declined to publish my action on Kongregate’. Regardless of this, Facebook absolutely received data on my action. See for yourself, here is a list of all the requests that are made when Beacon fires up the Toast.
But what you have to look at is the data is sent with all of those requests. I’ll just show you one of the scripts. The bold name (such as ‘action_name’) is the name of the variable, and the text to the right of the variable is the data for each variable that was sent.
As you can see, regardless of the fact that I clicked ‘No Thanks’ the data of my action as well as the url of the page I viewed was indeed sent to Facebook. In fact, clicking ‘No Thanks’ sends no additional data to Facebook, all it does is run javascript to close the Toast window. As I said previously, just because we can’t see the data (by opting out), this doesn’t necessarily mean that the data is not there. I’m not saying that Facebook is storing this data, there is no way for me to know. But they are without a doubt receiving it. So the question that Facebook absolutely needs to make clear is simply: “When we click ‘no thanks’ or opt-out of a site, is that data then being deleted and therefore not stored anywhere?”