Home/ Questions/Q 7803199
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-02T01:29:50+00:00

EDIT: This question is wrong, see end. I’m in the midst of integrating Facebook

  • 0

EDIT: This question is wrong, see end.

I’m in the midst of integrating Facebook with my website and am following the standard client/server authentication setup, with all of its amusing token exercises, permission requests and what have you. This is necessary because we want to utilize extended permission data, execute posts etc.

But if we were only interested in Facebook as an authentication method, it seems we could do the whole thing without the user even knowing about it. If we only need a way to keep track of a user’s behavior on our site and remember it from visit to visit, we just need to be able to persistently and uniquely identify him or her. To this end, the Facebook userid is adequate and can be easily queried with the js or php sdk–without the user ever seeing or approving of anything.

This seems a bit indelicate in terms of privacy but is fully within the publicly available information/tools that Facebook supplies. It also makes a lot of sense for a lot of applications–person tries out your site and later decides to sign up for real and they can inherit all of their past activity, fully authenticated users can see what their friends have done on the site even if those friends didn’t agree to be tracked…

Is this in violation of Facebook’s ToS or otherwise unfeasible? I’m surprised that I haven’t encountered it more often (unless it’s just well-hidden 🙂 ).

EDIT: This question is based on an incorrect interpretation of my debug data and thus on incorrect premises. Getting the userID would indeed be the enormous privacy hole that it appears to be and would require at least a little bit of hacking to extract.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    This is a violation of everything that privacy stands for and it’s technically not possible too with facebook. You won’t get the users facebook-id unless you at least get them to like your application.

    So without interaction: no
    Try a cookie…

    And yes in fact you’re probably violating Facebooks ToS too:

    They say here: https://developers.facebook.com/policy/

    Create a great user experience

    • Give users choice and control

    Be trustworthy

    • Respect privacy

    And i can’t see a better example than yours to violate this 😉

    • 0