In the wake of reports that popular Facebook applications are transmitting user information to ad networks, Facebook on Thursday announced plans to encrypt user IDs going forward.

Facebook will enable optional encryption over the next few weeks and then work with developers to ensure a complete transition to encryption in the future, Mike Vernal, a Facebook engineer, wrote in a blog post.

Earlier this week, The Wall Street Journal published a report that said many Facebook applications share users' personal information with advertising networks and other Internet-tracking companies. The problem affects tens of millions of Facebook's 500 million users, the Journal said, and all of the social-networking site's top 10 apps.

The report prompted two members of Congress to write to Facebook chief Mark Zuckerberg and demand more details on what type of information was being distributed.

On Thursday, Vernal said "initial press reports greatly exaggerated the implications" of sharing a Facebook user ID (UID) and provided some more details about what happened.

When a browser loads information, the browser sometimes sends an HTTP header that identifies the URL of the page with that information. Certain types of apps written on Facebook Platform known as iframe-based canvas apps might contain the UID of a Facebook user in its URL after that user has authorized an application.

"This UID is included in order to enable the application to build a personalized experience for the user," Vernal wrote.

In the wake of the Journal story, Vernal said some developers have been using techniques to remove the UIDs from the URL. Developers can issue these fixes on a case-by-case basis, but Vernal said Facebook wanted to "find a solution that would address the issue for all applications on the Facebook Platform." As a result, Facebook will start encrypting the parameters it sends to iframe-based apps, Vernal said.

"The proposal builds on our recent support for a parameter called signed request which is inspired by our discussions in the OAuth community," he wrote. "We will start encrypting this parameter as well, using the application's secret key, so that only the application will be able to read this information. This will prevent the accidental disclosure of this information via HTTP headers."

Initial encryption parameters will be enabled in the next few weeks, and will eventually be applied to various Facebook SDKs. "Once the design is finalized, we will work with our developers to ensure a speedy transition to encrypted parameters," he said.

Vernal concluded by saying that HTTP header sharing is not exclusive to Facebook; it's a "Web-wide problem" and Facebook will work with the Web standards community and browser vendors in the next few months to address the issue, he said.