Logging out of Facebook is not enough
Dave Winer wrote a timely piece this morning about how Facebook is scaring him since the new API allows applications to post status items to your Facebook timeline without a users intervention. It is an extension of Facebook Instant and they call it frictionless sharing.
Context & Ripple Effects
The argument lands four years into a running Scripting News arc about Facebook's terms: Dave Winer argued in August 2007 that Facebook was genuinely opening up, then by October that year concluded it sucked anyway. Nik Cubrilovic's piece sharpens that old openness critique into a technical claim — that the new API behind 'frictionless sharing' posts to your timeline without intervention, and that logging out does not end Facebook's visibility into your browsing.
The timing matters: Facebook unveiled Timeline on September 22, 2011, making ambient sharing the design centerpiece of the profile, and Winer published his alarm the same morning Cubrilovic responded. The story traveled fast enough that This is my next picked it up the same day under a headline arguing the new sharing is anything but 'frictionless.'
First-order effects
- Users who log out of Facebook believing they have severed the connection are still sending identifiable requests to Facebook from every page carrying its widgets — the logout state no longer matches the privacy expectation it signals.
- Facebook's new API, launched alongside the September 22 Timeline announcement, now posts status items to user timelines without per-item action, putting Winer's and Cubrilovic's objections directly against a feature the company is actively promoting.
Second-order effects
- Publishers wiring their sites into frictionless sharing inherit the backlash: their readers' reading habits flow to timelines without explicit consent, so news organizations' brands ride on Facebook's default rather than their own.
- Rival platforms and browser makers gain an opening to differentiate on explicit opt-in sharing and visible controls, turning logout behavior into a competitive talking point.
Third-order effects
- If default-on sharing holds, consent migrates from the individual action to the account level, forcing the question of whether 'logged out' carries any legal or contractual meaning for trackers.
- Sustained scrutiny of post-logout tracking points toward external accountability — regulator or standards-body involvement — as the mechanism users cannot rely on platforms to self-enforce.
The trend: Social platforms are shifting sharing defaults from explicit opt-in clicks to ambient, always-on capture, transferring the privacy burden from the moment of sharing to the standing configuration of the account.