91

Facebook has served me an ad for a website I visited earlier in the day. I have third party cookies disabled and have not followed any links between the website and Facebook (links which could contain a tracking ID connecting my Facebook account to the website).

Without third party cookies, how can Facebook know that I visited the website?

Improve this question
11
  • 20
    If the site you visited had a "like", "share" or something else related to facebook, the website can track you. If you don't want that anymore, you can install on your browser an useful extension named "Facebook container" that automatically blocks Facebook scripts in any external site. Note that if you use that extension, you can't anymore use Facebook's "like" button, etc., in external site.
    – DioCanada
    Commented Nov 10, 2019 at 22:59
  • 22
    Shout out for the EFF extenstion Privacy Badger. It replaces the Facebook widgets with its own version that can't be tracked.
    – Darren
    Commented Nov 11, 2019 at 9:34
  • 3
    "an ad for a website I visited earlier in the day" => Mine is a comment. You are assuming FB served that ad on the assumption they know about your visit. Exactly like the "FB is hearing us" dispute, this could also be explained under a cognitive bias hypotesis. Maybe the site is performing a huge campaign, and not necessarily FB provided that ad on the grounds that they had record of your visit. Yet again, mine was just a comment
    – usr-local-ΕΨΗΕΛΩΝ
    Commented Nov 11, 2019 at 10:42
  • 14
    Pfft, you're living in the past. Nowadays I merely talk to my wife about something and if my phone is within an earshot of us then I'll get an ad for the item next time I open Facebook.
    – MonkeyZeus
    Commented Nov 11, 2019 at 14:00
  • 2
    Related on Meta Stack Overflow: Stack Overflow lets Facebook track us across their sites.
    – Davy M
    Commented Nov 12, 2019 at 9:01

5 Answers 5

Reset to default
120

Facebook does not need to use third-party cookies to track you as you move from site to site, if the sites contain Facebook's javascript code (e.g. for the Facebook 'like' button). In this case, Facebook's javascript code can place first-party cookies on your system, and communicate back to Facebook's servers to show you ads based on sites that you've visited previously.

Improve this answer
2
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Rory Alsop ♦
    Commented Nov 24, 2019 at 14:25
  • The variant using Facebook’s JavaScript SDK is only one of two possible implementations for the Like Button. The other one uses frames, where setting first-party cookies is not possible.
    – caw
    Commented Dec 13, 2019 at 18:26
25

In addition to the other answers:

The website you visited could have sent information about your visit directly to Facebook using their "Server-side API".

This doesn't need any client-side scripting technology to be enabled, because all communication happens between the 3rd party website and Facebook.

The more information you give the 3rd-party site, the more they can share with FB. The bare minimum is your IP address. If you have an account then your email address could be shared. If you make a purchase then all of that can be shared, too.

If the website used both client-side scripting and server-side communication to tell Facebook about you, then the fact your visit generated a server-side event but not a corresponding client-side event shows to them that you use an ad-blocker. This information can also be saved and potentially used to serve you different content in future.

Improve this answer
10

There are more ways to keep track of your browser fingerprint.

For example the following data may be used for finger printing:

  • Operating system
  • Installed fonts
  • Installed Browser add-ons
  • User agent, shows your version of your browser
  • IP address
  • Screen resolution
  • etc...

There are sites where you can check your browser fingerprint like these: https://amiunique.org/

Facebook has a Server Side API where API's can send events directly to the Facebook servers. This includes forwarding the client_user_agent which contains your browser fingerprint so they can match these requests to identify you.

Improve this answer
11
  • 2
    How does the browser fingerprint help in this case? This is not a case of a returning user.
    – schroeder ♦
    Commented Nov 11, 2019 at 12:32
  • 2
    This answer is very generic.
    – northerner
    Commented Nov 11, 2019 at 13:52
  • 1
    @schroeder You're a returning user to Facebook. How else would you see the ads?
    – user20574
    Commented Nov 11, 2019 at 15:23
  • 2
    Not even as a Facebook user, but they keep Shadow profiles of non-users to keep track of them.
    – com2ghz
    Commented Nov 11, 2019 at 16:01
  • 1
    Because the other site is probably doing something similar. There is no other way that Facebook will get your data.
    – com2ghz
    Commented Nov 11, 2019 at 16:11
7

I want to clarify that what you are seeing is most likely a retargeting advertisement (Learn more at wikipedia). The website you visited may be voluntarily sending data to Facebook in order to serve ads to you when you browse other websites, such as Facebook.

You can learn more about this from Facebook's B2B Marketing page and their Developer Documentation. Note that even if you block Javascript and third party cookies, there is still a no-script tag which loads an image (tracking pixel) which will leak some information to facebook's servers. This is why you need a browser plugin which has blacklists in order to truly browse privately.

If you are curious about the mechanics, this answer about tracking pixels goes into more detail.

Improve this answer
1

Just have a look at the site of the Electronic Frontier Foundation www.eff.org and search on Browser. You will find many articles, dated 2010, on browser fingerprinting without cookies.

Also, just see for yourself how unique your browser is on the Panopticlick site

I also remember a similar EFF test site that shows you how many other browsers share particular fonts etc on your browser, but could not find that site.

Improve this answer
4
  • Browser fingerprinting is already covered in another answer and that's not how it works.
    – schroeder ♦
    Commented Nov 12, 2019 at 15:12
  • Also, answers which are just links to things which may or may not answer the question, are not themselves valid answers to the question. Paraphrase the material in your answer to make your answer useful.
    – Beanluc
    Commented Nov 12, 2019 at 18:08
  • 1
    @Beanluc I did not "just" mention a link, but annotated that it is some authoritative collection of info. Also that the issue is about 10 years old, as a subtle hint about the value of the question. The Panopticlick site makes it possible to actually find out yourself how fingerprinting works.
    – Roland
    Commented Nov 12, 2019 at 22:24
  • @schroeder Many answers I have seen on lots of questions contain duplicate material, without complaints. Often, there is a slight twist that distinguishes answers. And if fingerprinting is not the answer, not how it works, that would be another topic.
    – Roland
    Commented Nov 12, 2019 at 22:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .