It appears that some privacy protection tools (I use Privacy Badger in Chrome) block the domain on Stack Exchange sites. That means that the avatar doesn't load.
It seems like this issue on the GitHub for Privacy Badger describes what I'm seeing. The comment seems to indicate that it may be OK (from a privacy standpoint) to move the setting from blocking the domain to blocking cookies. This resolves the issue of loading the resource. However, the issue has been closed.
I think that more research is necessary, and this research should be done by SE (since they have made the design decision to defer elements to a third-party). If the
graph.facebook.com domain is unsafe or tracks users, this should be considered unacceptable behavior and not used on the network. If
graph.facebook.com is a safe domain and does not perform any kind of tracking of users, this should be clearly stated. Stack Exchange or an affected user should relay the findings to the makers of these third-party tools (in my case, Privacy Badger, but perhaps others) to find appropriate resolution.
In the mean time, if people are seeing these blocked images, they should be checking the settings on their protection tools. I know this setting made chat look really awful when certain users were in the room.
- Why are we using "graph.facebook.com" in the QA sites but not on their meta sites? discusses the use of the Facebook CDN when a user links their SE account to their Facebook account
- Privacy and policy issues exposing Facebook User IDs talks about the implications of having a user's Facebook ID associated with their SE profile.
- Do not load Facebook-based avatars directly from the Facebook CDN is for the idea of not using the Facebook CDN to load avatar images, but from the perspective of being able to link an SE profile to a Facebook profile and not a tracking cookie perspective.
- Move profiles images to imgur when linking Facebook/Twitter profiles is an exact duplicate of the above question.
- Is Gravatar a privacy risk? discusses similar privacy concerns around Gravatar. In my particular case, cookies from Gravatar are blocked, which hampers their tracking ability. Other privacy tools also appear to block Gravatar tracking cookies.