“When a Facebook user takes a Beacon-enabled action on a participating site, information is sent to Facebook in order for Facebook to operate Beacon technologically. If a Facebook user clicks “No, thanks” on the partner site notification, Facebook does not use the data and deletes it from its servers. Separately, before Facebook can determine whether the user is logged in, some data may be transferred from the participating site to Facebook. In those cases, Facebook does not associate the information with any individual user account, and deletes the data as well.”

This seems like a non-denial denial, but lets just assume they are doing the right thing – they have had a rough weekend. After all they were denied their request to take down some confidential documents that were made available on the 01238 magazine website as part of an article called, Poking Facebook.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• How consumer media will change in 2013
• Social 2013: The enterprise strikes back
• Examining the rise of crowd labor platforms in 2012

In a classic example of marketing doublespeak, the company saw privacy concerns as an issue in the minds of pundits. (Never heard them complain about pundits praising their “innovations.”) A few hours later, the Palo Alto-based company outdid John Kerry when it came to flip-flopping and announced what are being perceived as big changes to the Beacon system. Why? Because it was not the pundits, but instead Facebook users who were up in arms about it. Facebook finally backed down, more or less acquiescing to the demands of those concerned about its seemingly blatant abuse of privacy of its fast-growing user base. Now you are explicitly asked whether to publish or not publish the information that is being innocuously called “stories.” There doesn’t seem to be a universal opt-out, however.

Regardless, I think it is laudable that Zuckerberg’s crew is at least listening to its community and responding accordingly. [FAQ on New Beacon] Of course, the cynical take on this would be: it isn’t the last time they are going to test the outer limits and see what they can get away with. And how much of these changes were instituted to ensure that the potential advertising partners don’t get scared, putting the future revenue streams at risk? (Maybe the Beacon flip-flop was influenced by the fact that Facebook was negotiating to get a $60 million investment from Li Ka-Shing, the Chinese tycoon who has previously made a killing with his tech investments.)

There is one issue that remains unanswered. During my initial inquiries, when I asked the company executives if Facebook continues to collect data even if that data (stories if you may) wasn’t published. They assured me that is not the case, and gave me written and verbal assurances. Those doubts have resurfaced, largely because of the language used by Facebook in their statement regarding changes to Beacon.

If a user does nothing with the initial notification on Facebook, it will hide after some duration without a story being published. When a user takes a future action on a Beacon site, it will reappear and display all the potential stories along with the opportunity to click “OK” to publish or click “remove” to not publish.

Following their argument, unless they are storing information being sent to Facebook from the partner sites, it is unlikely that “all potential stories be published at a later stage.” It can’t be auto-magically recreated from thin air.

Users will have clear options in ongoing notifications to either delete or publish. No stories will be published if users navigate away from their home page. If they delay in making this decision, the notification will hide and they can make a decision at a later time.

If you decide to opt out completely, you are in the clear, but if you forget to do so, and take no action, then the Facebook system will keep collecting data. In other words, Beacon continues to do its job — collect information from partner sites and also fine-tune the advertising system. From that perspective, nothing has really changed. Except perhaps the public perception that Facebook listens to its community.

(Dan Farber’s take on changes in Beacon is smart and worth reading.)

Update: CA Security Advisor Research Blog has tangible proof and details on information flowing back to Facebook from partner sites.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Social media in Q1: commerce and discovery dominated
• Google doesn’t like walled gardens — except its own
• Controversy, courtrooms and the cloud in Q1

But that may not go far enough in protecting users’ privacy. Some people may also want the ability to stop Facebook not just from publishing information from third-party sites, but also from gathering that information at all.

Many Facebook users have complained that they shouldn’t have to opt out every time Facebook wants to publish transaction information from third-party sites. Besides, some critics say, the opt-out notices are so subtle that many people don’t even notice them.

Blogger and Wiley marketing director, Ellen Gerstein, discovered how subtle those notices were when she congratulated her babysitter on buying a purple ski jacket. Her babysitter had no idea that her Overstock.com purchases were shared on Facebook. Ellen said, “I cannot imagine I would want anyone on Facebook to know what I am purchasing.”

When Facebook announced Beacon, Om called it a potential privacy hairball, noting that even if you opt out of the information publishing, Facebook still knows what you’re doing.

Bokardo blogger Joshua Porter highlights this same problem:

Most people are worried about what happens when the shared information gets back to Facebook, and their Facebook friends see their outside activity….

My main concern was that Facebook and Blockbuster were talking at all.

So when the Facebook announcement comes out, we should be looking not only for the ability to opt out of publishing transaction information to Facebook, but the ability to opt out of sharing any information outside of Facebook as well.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• NewNet Q3: Facebook remakes headlines in social media
• How consumer media will change in 2013
• Social 2013: The enterprise strikes back

Updated: Facebook Responds, and explains.

It has been 48 hours since I asked Facebook to clarify the point about whether a user’s data is still being passed to them from their web partners even after the user chooses to opt out of Beacon.

I’ve since given it a lot of thought and decided that I was not being judgmental in my previous post. Here, after all, is what Mark Zuckerberg told Portfolio.

* “The ads are going to feel like content to a lot of people.”
* “There is no opting out of advertising.”

Scary, isn’t it? Anyway, Nate Weiner, writing on Idea Shower, is also worried about Beacon — and he’s come to a similar conclusion: Any opt out is that of perception and publishing. (He came to this conclusion while playing games over on Kongregate.)

The problem however is, that even though you can choose whether or not it is made public that you visited these sites, Facebook still has the data regardless of your privacy settings. Now I don’t mean to sound like I’m tin-foil-hat-wearing paranoid, but that does seem to encroach a little past what Facebook’s role in my life should be.

Weiner (via Deep Jive Interests) has suggestions on how to avoid the whole Beacon thing — you need to use this Firefox plugin. My view is this: Let’s not use the 44 sites that have partnered with Facebook till each one puts a public disclosure on their site saying that no data is being passed to it.

It is going to be hard living without some of these big giants, but in most cases there are options. For instance, Fandango, which is owned by Comcast (CMCSA), is not going to get any business from me — 777 Film is a good alternative. Blockbuster (BBI) gets the boot, and eBay (EBAY)? Okay maybe I am being a little paranoid!

And as far as Facebook is concerned, I am still waiting for their clarifications.

Updated: Here is what Facebook says. I am also speaking with one of their senior executives on Monday, so if you have any questions or concerns, please let me know.

Facebook designed Beacon so Facebook users could choose to share information about interesting actions they are taking on other websites with their friends on Facebook. As part of Beacon, Facebook built several ways that users can choose to not share any information. Each time an action can be shared, users receive a prompt on a Beacon-participating site where users can choose “No, thanks.”

If they choose not to share a specific action, Facebook immediately deletes and does not store any data that was used to generate the Beacon. In all cases, Facebook does not share any personally identifiable information with participating sites.

Along with the choices a user has on a Beacon site, users also have the ability to change their settings on Facebook. A user can select to remove any participating Beacon site from ever sending any information to Facebook to share with their friends.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• How consumer media will change in 2013
• Social 2013: The enterprise strikes back
• Examining the rise of crowd labor platforms in 2012

While it seems to be a clever idea, a quick review reveals that Beacon might turn out to be a privacy hairball for the company.

The 44 sites that have partnered with Facebook include everyone from Kongregate, LiveJournal, NYTimes (NYT), Sony Online, Blockbuster (BBI), Bluefly.com, STA Travel, The Knot, TripAdvisor, Travel Ticker, TypePad, viagogo, Vox, Yelp, WeddingChannel.com and Zappos.com.

These partner sites put a little a piece of Facebook javascript on their web site and certain information, cleverly (and innocuously) labeled as a user alert, is sent to Facebook. For instance, Fandago users can publish information about the movies they saw. It all seems like a clever idea because it lets Facebook triangulate your likes and dislikes even more, and deliver more focused ads.

Facebook Beacon provides advanced privacy controls so Facebook users can decide whether to distribute specific actions from participating sites with their friends.

Reading that line prompted the following questions, which I put to Facebook:

1. Can consumers opt out of this?
2. If yes, does their data get erased?
3. Will the sites for example, Fandango, stop sending all personal and any kind of information to Facebook once the user opts out?
4. Why didn’t they make this an opt-in feature, instead of being an opt-out feature?

Their PR spokesperson emailed me this response:

Users can opt-out of Beacon on a per-site basis. They can opt-out for each action, or they can opt-out to never have an affiliated site send stories to Facebook. For instance, a user that buys The Notebook from Blockbuster can stop a story from being published about it, or she can opt-out of having Blockbuster publish any actions she takes on the Blockbuster site.

The response doesn’t seem to answer my questions and basically makes it seem like users have control over this data, when in reality, this is a privacy disaster waiting to happen. The javascript on the Fandango site pops up a little screen which asks if you want to publish the information on Facebook. If you say no, your friends won’t see the information, but apparently Facebook still receives it. This means that if you are a Facebook member, Facebook will know what you are doing on each of their partner sites. And there is no way for you to opt out of that. Or is there? I asked Facebook to clarify and I am still waiting for them to write back.

As for the rest of their announcement, while long and elaborate, it doesn’t contain any information we haven’t already seen. MySpace (NWS) has been doing brand specific-pages for a while now, in addition to using other targeting techniques.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• The evolution of the virtual goods market
• How social discovery is transforming entertainment
• Monetizing music in the post-scarcity age

Social media standards pioneer Dave Winer says, “Google has a long way to go to build the base of users and developers connected using the new protocols that is the subject of all this chest-thumping” and calls it a tech PR war. That it is, though it could have far-reaching effects on the web. Most tech standards efforts come to nothing, but if Google is successful in getting many big and little social nets speaking one language internally, it may not be too long before they start discussing amongst themselves, too.

That’s both happy and sad for the users, who may finally get their longed-for universal online social graph at the same time they open themselves up to constant and intrusive socially-based advertising.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• GigaOM Research highs and lows from CES 2013
• How HR can make the case for workforce analytics
• The 2013 task management tools market