The dominant social network tells users it won't share their details without consent, but according to the Wall Street Journal, it has handed over information that advertisers can use to look up individual profiles.
MySpace had a similar loophole, it's reported. Both sites said they were making changes to stop the handover.
Advertisers were getting reports whenever users clicked on their ads, as is typical across the web. However, Facebook and MySpace's reports contained the URL of the user's profile page, which often included their real name or user name. Neither site had bothered to obscure the data, in breach of their own privacy policies.
It's just the latest privacy failing by Facebook, which has suffered heavy criticism this month. Major changes to its privacy settings are expected after it decided to publish users' private information, and IM transcripts showed CEO Mark Zuckerberg calling those same users "dumb fucks" for trusting him with their data. ®