Facebook Tracking Through Social Plug-ins

Technical report prepared at the request of the Belgian Privacy Commission in the context of its Facebook investigation.

Download the tech report »

Overview of findings

Please consult to the technical report for our methodology, scope and detailed findings.

Tracking cookies

Table 1: List of uniquely identifying cookies sent to Facebook when a site with Facebook social plug-ins is visited. The table gives a partial overview of the cookies used by Facebook. See the technical report for more details.
Cookie Contains1 Purpose1 Lifespan Logged-in Logged-out Deactivated2 Non-user
Browser ID Site security and integrity 2 years Sent Sent Sent Sent3
Facebook ID Authentication 1 month / Session4 Sent Not sent Not sent N/A5
Encrypted Facebook ID and Browser ID Advertisement 3 months Sent Sent Sent N/A

1: The descriptions are taken from Irish Data Protection Commissioner's 2011 audit and 2012 re-audit. 2: Deactivated also means logged-out. 3: If the non-user already has this cookie, e.g. if she has visited a Facebook page. 4: Cookie's lifetime depends on the “Keep me logged in” checkbox. If the box is checked, cookie will expire in 1 month, otherwise it will be removed at the end of the session. 5: Not applicable, the cookie in question is only set for Facebook users.

Frequently Asked Questions

Tracking of non-users

Q: How does Facebook use social plug-ins to track non-users?

A: Facebook sets a tracking cookie (datr) when a non-user...

Once the cookie is set, all the later visits to sites that include Facebook social plug-ins can be tracked and linked by Facebook using that cookie.

Q: Can Facebook track me even if I don't click the social plug-ins?

A: Yes. Visiting a page with social plug-ins is enough for being tracked once you have the cookie (see above).

Q: Does Facebook only set cookies on Facebook pages (when it's a first-party)?

A: No. For example, Facebook sets a tracking cookie (datr) on certain sites that use Facebook Connect (e.g. myspace.com, mtv.com, okcupid.com). Facebook also sets the same tracking cookie on the European Digital Advertising Alliance website if you try to opt-out.

Q: Do Facebook social plug-ins set cookies?

A: Mostly no. But on a small number of sites, Facebook social plug-ins do initiate a request to a URL starting with pixel.facebook.com/si/kappa/ which then sets a tracking cookie (datr).

Q: In the report you say Facebook sets a tracking cookie on the European opt-out site, but not on the US & Canadian site. Why the difference?

A: We have no idea.

Tracking of Facebook users

Q: Is logging-out enough to avoid Facebook tracking through social plug-ins?

A: No. When you log-out, Facebook still receives cookies (fr, datr) that uniquely identify you and your browser.

Q: Does deactivating my Facebook account stop Facebook tracking through social plug-ins?

A: No. When you deactivate your account, Facebook still receives cookies (fr, datr) that uniquely identify you and your browser.

Q: Are social plug-ins the only Facebook component which track Facebook users on the Web?

A: No. For example, many sites use Facebook's Audience pixels to add their visitors to custom segments and retarget them on Facebook with Facebook Ads.

Q: Does Facebook stop tracking me when I opt-out on the sites suggested by Facebook?

A: No. Facebook will still receive the same information about your visits to external sites containing Facebook social plug-ins. Facebook only promises to no longer use this information for the purposes of interest-based advertising.


Q: I'm an end user, how can I easily protect myself against social plug-in tracking?

A: You may use browser add-ons that block tracking such as:

Q: I'm an online publisher/blogger/webmaster. How can I prevent tracking of my visitors without removing my social plug-ins?

A: Use Social Share Privacy. In this case, the plug-ins will not connect to the third-party servers of social plug-ins until the user clicks on them.

Q: I use Wordpress/Joomla. Is there a plug-in I can use to enable privacy friendly sharing on my website?

A: Check the following Wordpress and Joomla plug-ins