Skip to main content
7 of 7
added 14 characters in body
  • 66.9k
  • 11
  • 99
  • 224

Off-site avatar images are a privacy risk

The user avatars that are displayed on every post are not all hosted on SE's imgur account, but on sources outside the control of Stack Exchange. The most prominent ones are Gravatar, Facebook and Google.

The consequences of this decision to allow off-site avatar hosting are that every time I open a page SE is broadcasting which page on SE sites I'm browsing.

In the simplest case, the information transferred is my IP address, my browser user agent and the site I'm looking at. While this is not data that identifies me directly, it is likely within the power of a company like Facebook or Google to associate it with other tracked data and identify some users this way.

I just tried the worse case and logged into Gravatar. In this case, when logged in, a cookie that uniquely identifies my Gravatar account was sent along with every Gravatar image on the page. So Gravatar can create an almost complete browsing history for a logged in user given how prevalent Gravatars are on SE sites.

Google doesn't send a cookie in this case, I don't know about Facebook as I don't have an account there.

As far as I understand, those sites are also not bound by the SE privacy policy, as SE probably doesn't have a contract with Facebook and Google on how they can use this data. So I don't know what they can do with this data and where the limits are.

I'm not a laywer, so I can't judge the legal aspect. But an interesting comparison are e.g. court cases in Germany where the Facebook "Like button" was declared illegal in some circumstances because it submits information to Facebook without getting user consent before.

The off-site avatars also have other drawbacks. Gravatar has been less than stable in the past at times, and as it's entirely outside the control of SE they can't fix any issues like this. The Facebook avatars are blocked by the default setting of the Firefox tracking protection, so anyone using Firefox with this enabled will see a slightly broken SE site. Firefox is also enabling tracking protection by default now, so this will affect a lot more people soon.

SE should stop hosting avatars on other sites, to prevent their users being tracked by those sites.

As an example, this is how MSE looks like when I enable the more strict version of the Firefox tracking protection. Every broken avatar there is an image that submits information to somewhere outside SE's control.

Mad Scientist
  • 186.7k
  • 74
  • 358
  • 666