This article claims that Facebook tracks what you do, even when you're logged off of Facebook, via cookies.

Now, a cookie is just a text file... that is read/written to while you're actually on that site, correct? If I'm on Google, how is Facebook writing to a cookie at that point?

My site uses Fb login, so my users are asking me about how all these changes Fb has gone through recently affects their privacy, and they're linking me all these articles that sound false to me.

4 Answers 4


That article is almost certainly based on, though doesn't bother citing, a post from Nik Cubrilovic that made the round this past weekend. (And if not based on his post, he at least explains the claims.)

For one, the other answers mentioning this would only apply to sites integrating Facebook are correct. But it's also worth noting Facebook have responded and addressed the problem, largely satisfying the complaints brought up in the original post. Nik's site seems to be having some problems at the moment, so here's a summary post at ZDNet also.


Any website that has FaceBook code in it that originates from Facebook (i.e. like button) allows Facebook to track where a user has been. This is because the FaceBook code on your website is from the same domain as the cookie thus giving the cookie access to the user's current whereabouts.


Lots of websites have bits of Facebook code embedded in them, such as Like buttons, and because that code is loaded from Facebook your Facebook cookies get passed to Facebook and they can tell you were on that site. It's quite true that Facebook can't track you when you visit web page that doesn't load anything from Facebook.


As Su explained, the issue stems from a post by Nik Cubrilovic. Here's how the theory went:

When you log into Facebook, the sites sets some cookies in order to authenticate you on every page load. These cookies are obviously linked to your account.

When you visit a page with a Facebook Like button, it is actually some Javascript that creates an iframe of a facebook.com URL. For security reasons the iframe cannot directly access the calling page, nor can the calling page access the iframe. However the original Javascript passes the URL of the current page to the iframe (e.g. the iframe URL would be something like facebook.com/like.php?source=http://yoursite.com)

The issue discovered by Cubrilovic was that when you log out of Facebook, although it deletes all authentication cookies, it didn't delete a particular cookie that was uniquely linked to your account. When you visited any Facebook page in the future, although you weren't logged in, Facebook could in theory know who you were (or rather, who was the last user to log on to Facebook using this computer and browser). Of course, this implies that anywhere the Facebook Like button was being used, Facebook could link the website you were visiting with your account.

Facebook has stated that these cookies were never used for tracking purposes. They have now fixed the issue so that no account-identifiable cookies are kept when you log out. Some other cookies still persist, which uniquely identify the browser you are using - they claim this is necessary for spam purposes.

As for your specific question, if I'm not mistaken Facebook Connect requires visiting the Facebook site directly, and once back on your site no further contact with Facebook is made, so this is a different issue to the Like button. Facebook almost certainly tracks which domains are being logged on to with Facebook Connect, but it isn't able to track exactly which pages are being viewed and when.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.