'Like' Button Follows Web Users
These so-called social widgets, which appear atop stories on news sites or alongside products on retail sites, notify Facebook and Twitter that a person visited those sites even when users don't click on the buttons, according to a study done for The Wall Street Journal.
These widgets are prolific. They have been added to millions of web pages in the past year. Facebook's buttons appear on a third of the world's 1,000 most-visited websites, according to the study. Buttons from Twitter and Google Inc. appear on 20% and 25% of those sites, respectively.
The widgets, which were created to make it easy to share content with friends and to help websites attract visitors, are a potentially powerful way to track Internet users. They could link users' browsing habits to their social-networking profile, which often contains their name.
For example, Facebook or Twitter know when one of their members reads an article about filing for bankruptcy on MSNBC.com or goes to a blog about depression called Fighting the Darkness, even if the user doesn't click the "Like" or "Tweet" buttons on those sites.
For this to work, a person only needs to have logged into Facebook or Twitter once in the past month. The sites will continue to collect browsing data, even if the person closes their browser or turns off their computers, until that person explicitly logs out of their Facebook or Twitter accounts, the study found.
Facebook, Twitter, Google and other widget-makers say they don't use browsing data generated by the widgets to track users; Facebook says it only uses the data for advertising purposes when a user clicks on a widget to share content with friends.
Facebook and Google, which has a widget for its "Buzz" social-networking service, say they "anonymize" browsing data so the information is not traced to a particular user. Facebook says the data are deleted within 90 days, while Google says data are deleted within two weeks. Facebook and Google say they use the information to measure the widgets' effectiveness and help other websites attract visitors.
Twitter says it doesn't use such browsing data and deletes it "quickly." A spokesman says the company could in theory use the data to "surface better content" for users in the future.
Revelations about the social widgets come amid growing concern about the privacy of Internet and smartphone users. Members of Congress have introduced at least five privacy-related bills this year, including three that aim to create a mechanism that would let users disable tracking.
Some privacy advocates express concerns, citing prior Facebook and Google stumbles over privacy issues.
"Our reading habits online encompass everything we're thinking about, political and religious views, health and relationship problems," said Peter Eckersley, a senior technologist at the Electronic Frontier Foundation, a privacy-advocacy group. "Do you want to have an invisible person peering over your shoulder as you walk through the library?"
Widget makers say the collection of users' Web-browsing activity is an unintended side effect of how the tools work. In order to show a user which of their online friends "liked" a particular article, for example, the widget must know who the user is.
To determine the prevalence of widgets and how they collect information, the Journal asked Brian Kennish, a former Google engineer, to examine the 1,000 most-popular websites, as ranked by Google's advertising network. Mr. Kennish last year launched Disconnect Inc., which offers software to block data collection by widgets.
Mr. Kennish's study examined more than 200,000 Web pages on the top 1,000 sites. He found Facebook obtained browsing data from 331 sites, and Google obtained data from 250 sites, some of it from its Buzz widget. Twitter got browsing information from about 200 sites.
Social-sharing widgets first appeared about five years ago, when online services such as Digg Inc. allowed users to share news articles. At the time, widgets did not cause browsing data to be collected by social sites. Widgets are installed by website owners, who like them because they can help generate more Web traffic.
Last year, Facebook introduced the "Like" button and other "smart" widgets. The widgets work with cookies that Facebook places in a Web browser when a user creates an account or logs in to its site. Together, they allow Facebook to recognize its users on any site with Facebook widgets.
Bret Taylor, Facebook's chief technology officer, says the technology lets websites show visitors what articles their friends liked, for example. "We don't use them for tracking and they're not intended for tracking," he says.
But Facebook says it still places a cookie on the computer of anyone who visits the Facebook.com home page, even if the user isn't a member. Mr. Taylor says Facebook uses such cookies to protect the site from cyberattacks by people who try to break in to users' accounts, among other things.
Until recently, some Facebook widgets also obtained browsing data about Internet users who had never visited Facebook.com, though Facebook wouldn't know their identity. The company says it discontinued that practice, which it described as a "bug," earlier this year after it was disclosed by a researcher in the Netherlands.
—Geoffrey A. Fowler contributed to this article.Write to Amir Efrati at amir.efrati@wsj.com
No comments:
Post a Comment