Beacon is a major part of the Facebook Ads platform that Facebook introduced with much fanfare several weeks ago. Beacon tracks certain activities of Facebook users on participating Web sites, including those of Blockbuster and Fandango, and reports those activities to the user's set of Facebook friends, unless told not to do so.
Off-Facebook activities that can be broadcast to one's Facebook friends include purchasing a product, signing up for a service and including an item on a wish list.
The program has been blasted by groups like MoveOn.org and by individual users who have unwittingly broadcast information about recent purchases and other Web activities to their Facebook friends.
On Thursday night, Facebook tweaked Beacon to make its workings more explicit to Facebook users and to make it easier to nix broadcast messages and opt out of having activities tracked on specific Web sites. Facebook didn't go all the way to providing a general opt-out option for the entire Beacon program, as some had hoped.
Then on Friday, just hours after Facebook had scored some points with its modifications to Beacon, Berteau published his note about Beacon's until-then unknown ability to monitor logged-off users' activities and send the data back to Facebook.
Users aren't informed that data on their activities at these sites is flowing back to Facebook, nor given the option to block that information from being transmitted, Berteau said at the time.
If users have ever checked the option for Facebook to "remember me" -- which saves users from having to log on to the site upon every return to it -- Facebook can tie their activities on third-party Beacon sites directly to them, even if they're logged off and have opted out of the broadcast. If they have never chosen this option, the information still flows back to Facebook, although without it being tied to their Facebook ID, according to Berteau.
Berteau plans to post another note at some point Monday evening detailing his latest findings.
Facebook didn't immediately reply to a request for comment.
However, Berteau said he had shared this latest finding with Facebook officials and they told him that Facebook deletes data that comes in from non-Facebook users and from deactivated accounts.
Berteau said he is encouraged that the Facebook officials he talked to seemed truly interested in his findings, and he believes that Facebook will make changes to address privacy concerns raised by his research.
Berteau's colleague Benjamin Googins last week posted an article with some suggestions for users who want to protect themselves from the Beacon tracking activities.