Congress has stepped into the Facebook tracking cookie issue, with two House members asking the Federal Trade Commission to investigate the issue.
Though Facebook issued a fix for several of the offending cookies, Reps. Edward Markey and Joe Barton said they "remain concerned about the privacy implications for Facebook's 800 million subscribers."
The Electronic Privacy Information Center (EPIC) today also filed a complaint with the FTC on the same issue.
At issue are Internet cookies, or little bits of data collected about your Internet activity. They can be useful—like remembering passwords and settings on sites that you surf to frequently—but there are also concerns about targeted advertising and how much data is really collected. That concern extended to Facebook this week when blogger and hacker Nik Cubrilovic said in a blog post that Facebook can track your Web activity outside Facebook.com even if you have signed out of the service.
"Even if you are logged out, Facebook still knows and can track every page you visit. The only solution is to delete every Facebook cookie in your browser, or to use a separate browser for Facebook interactions," Cubrilovic wrote.
On that initial blog post, Gregg Stefancik, a Facebook engineer, posted a comment and said that Facebook "cookies aren't used for tracking." In working with Cubrilovic, however, Facebook later identified several cookies that were unnecessarily saving user data after logout and after a browser restart. Cubrilovic has more of the technical details in an updated blog post, but as of today, the cookies, one of which identified your user account, are "destroyed on logout," he said.
However, Markey and Barton, co-chairs of the Congressional Bi-Partisan Privacy Caucus, wrote in a letter to FTC chairman Jon Leibowitz that "tracking user behavior without their consent or knowledge raises serious privacy concerns. When users log out of Facebook, they are under the expectation that Facebook is no longer monitoring their activities," they said.
The duo asked the FTC to investigate the issue as it relates to "protecting Americans from 'unfair and deceptive acts or practices.'"
EPIC, meanwhile, teamed up with the ACLU and several other groups to complain about the fact that even with the fixes, Facebook still tracks some cookies after logout. Facebook has said this is for security purposes, but EPIC said "options for users to preserve the privacy standards they have established have become confusing, impractical, and unfair." Like Markey and Barton, EPIC and the other groups want the FTC to investigate.
Facebook did not have a comment specific to the Markey-Barton letter, but in a statement about the tracking issue, it stressed that "there was no security or privacy breach—Facebook did not store or use any information it should not have."
When presented with the information about the cookies, Facebook said it "moved quickly to fix the cookies so that they won't include unique information in the future when people log out."
Questions about Facebook's activities beyond the confines of Facebook.com started up again last week after Facebook announced several integration deals with media companies like Spotify, Yahoo, and Hulu. If you add an app from these and other companies, your listening or watching activity will be shared with Facebook friends ("Chloe just watched an episode of '30 Rock' on Hulu"). This concept of an "Open Graph" first got started last year when Facebook unveiled its "Like" button as well as APIs that let people more easily share their Web activity on Facebook.
Of course, the concern is that you might not want to share everything you're doing outside of Facebook. Does everyone need to know you listened to a Justin Bieber song, read an article about how to get over your ex, or watched cartoons on Hulu? Some Spotify users certainly were not pleased, prompting the company to add the ability to shut off Facebook notifications.
For more, see PCMag's "When Facebook Gets Creepy" slideshow below.
Editor's Note: This story was updated at noon Eastern with EPIC's complaint.