Experts to Facebook: Mind Your Manners Facebook can repair the damage caused by the controversy around its Beacon ad system if the company follows basic social etiquette.

Facebook could have avoided the strident, weeks-long controversy engulfing its Beacon ad system if, when designing and deploying it, the social-networking company had followed basic social etiquette principles, such as being considerate and candid.

It's not too late, though. Following the common sense and time-tested advice of Mister Rogers and Miss Manners could help Facebook end the nightmare that threatens to harm its business, affect its relationship with advertising partners, and erode its end-users' trust.

That's the consensus from several industry observers and online privacy experts regarding the embattled Beacon, introduced several weeks ago to a sustained chorus of boos.

"Facebook created what it thought was a clever program and a lot of people didn't like it," said industry analyst Greg Sterling of Sterling Market Intelligence.

Beacon, part of the company's new ad platform, tracks certain actions of Facebook users on some external sites, like Blockbuster and Fandango, in order to report those actions back to users' Facebook friends network.

The idea: to generate advertising that is more effective because it is intricately combined with people's social circle, so that products and services are promoted in a more organic way via the actions of friends and family.

More than 40 Web sites have signed up for Beacon, although not all have implemented the system. Off-Facebook activities that can be broadcast to one's Facebook friends include purchasing a product, signing up for a service and including an item on a wish list.

Responding to a round of initial complaints that the program was difficult to understand, manage and avoid, Facebook tweaked it last Thursday, making its workings more explicit and giving people more control over it.

Although the changes didn't go as far as many had hoped, they were generally seen as encouraging. However, the calm didn't last long. On Friday, a CA researcher detailed tests showing that Beacon is more intrusive and stealthy than Facebook had acknowledged until then.

Stefan Berteau found that Beacon tracks users even if they are logged off from the social-networking site and have declined having their activities broadcast to friends.

In this case, users aren't informed that data on their activities at these sites is flowing back to Facebook or given the option to block that information from being transmitted, according to Berteau, senior research engineer at CA's Threat Research Group.

If a user has ever checked the option for Facebook to "remember me" -- which saves the user from having to log on to the site upon every return to it -- Facebook can tie his activities on third-party Beacon sites directly to him, even if he's logged off and has opted out of the broadcast. If he has never chosen this option, the information still flows back to Facebook, although without it being tied to his Facebook ID, according to Berteau.

Moreover, Berteau also found that Beacon doesn't limit its tracking to Facebook members. It actually tracks activities from all users in its third-party partner sites, including from people who have never signed up with Facebook or who have deactivated their accounts.

In those cases, Beacon captures detailed data on what users do on these external partner sites and sends it back to Facebook along with users' IP (Internet Protocol) addresses, although there is no Facebook ID to tie to the data.

The information captured by Beacon in these cases includes the addresses of Web pages visited by the user and a string with the action taken in the partner site, Berteau said.

Facebook's response to Berteau's research has been a brief statement in which it confirms the findings, but says that in the case of logged-off users, deactivated accounts and nonmembers, Facebook deletes the data upon receiving it.

Facebook's admission of Berteau's findings contradicted earlier statements from company officials.

Unsurprisingly, Facebook's reaction -- brief and lacking details -- has done little to calm the concerns and complaints arising from Berteau's research.

"Some say that if you belong to a social-networking site, you've given up your privacy. This shows that Facebook is the one that's really overreaching, collecting a lot of information from all over the place," said attorney Guilherme Roschke, a Skadden Fellow at the Electronic Privacy Information Center (EPIC).

EPIC believes that for this ad program to work properly from a privacy perspective, Facebook needs to give people full control over their information and obtain their explicit permission, Roschke said.

Facebook has declined repeated requests from IDG News Service to address the CA findings, which industry experts believe merit further modifications to Beacon and public comments from Facebook executives.

The tracking and transmission of data from logged-off users and non-Facebook members in Beacon sites "is a real no-no," Sterling said. "It crosses the line of propriety and, arguably, ethics."

Companies like Facebook are wrong to think that they are obtaining informed consent from their users to track them online as long as they place fine-print clauses in privacy policies written in complicated legalese.

"You need to get explicit, active approval for the tracking of your users and if you don't, you shouldn't track them," said Peter Eckersley, staff technologist at the Electronic Frontier Foundation (EFF).

It's also not helping that Facebook is having to reverse itself in light of evidence produced by independent observers like CA. "Facebook isn't being entirely candid about what it's doing and that's what's causing a lot of their problems," Sterling said.

Facebook urgently needs to infuse Beacon with a massive dose of transparency and do a significant transfer of control over the program to end-users, Sterling said.

Other online advertising providers should pay close attention to the mess in which Facebook has gotten itself into. "Everyone doing online tracking needs to be under the same scrutiny," Eckersley said.

A positive outcome from the brouhaha is that it has made people more aware of privacy threats online. "This controversy may help awaken consumers to the fact that [privacy violations] happen on Web sites everywhere all the time," said Beau Brendler, director of Consumer Reports WebWatch.

And awake people must be, considering that just as Facebook is trying to push the envelope of online advertising tracking and profiling, so are many other companies in this market, according to Joseph Turow, a professor at the University of Pennsylvania's Annenberg School for Communication.

"The more competition there is [in online advertising], the more we'll see this happen, and in more subtle ways," Turow said. "Beacon is symptomatic of a larger development in the trajectory of the Web."

Eckersley views the Facebook outcry as proof of the chasm that exists between people's privacy expectations online and the real-world actions of online ad providers. "When people become aware of that gap, they become very angry," he said.

In the meantime, Facebook has its hands full and must hurry to do damage control. Almost 70,000 Facebook members have signed an online petition, launched on Nov. 20 by MoveOn.org, protesting aspects of Beacon that the group feels are too intrusive of people's privacy.

While the privacy controversy is unlikely to cripple Facebook, the company must actively deal with the objections and concerns being raised. Beacon partners also have reason to worry about being associated with this program, he said.

"The danger lies in not addressing it, because the longer Facebook stays silent, the higher the chance that it will trickle down to its core user base. Facebook needs to take this seriously," Sterling said.

On Wednesday morning, after the interviews for this article had been conducted, Facebook CEO and founder Mark Zuckerberg announced in an official blog posting that the company had decided to give its members the ability to completely decline participating in Beacon.

He also apologized for missteps in the design and deployment of Beacon. "We've made a lot of mistakes building this feature, but we've made even more with how we've handled them. We simply did a bad job with this release, and I apologize for it," Zuckerberg wrote.

While this move will likely make Beacon more palatable to its critics, Zuckerberg didn't directly address any of the CA findings, which ultimately are the biggest points of contention right now.

In the only apparent reference to the CA findings, Zuckerberg wrote: "If you select that you don't want to share some Beacon actions or if you turn off Beacon, then Facebook won't store those actions even when partners send them to Facebook," he wrote.

That would seem to indicate that Beacon will continue to track users and send data back to Facebook, leaving it up to Facebook to decide which data it keeps and which it deletes.

Privacy advocates generally believe that Facebook shouldn't be tracking people's actions, let alone reporting them back to Facebook, unless they have expressly given their consent for that tracking to occur.

Facebook didn't immediately reply to a request for comment about Zuckerberg's blog posting.