Facebook privacy bug: Your likes are leaked

I just discovered that Facebook reveal to search engines the users who "Like" a page , regardless of their privacy settings. Try a Google search and see for yourself — if you've disabled "Public Search" for your profile that is:

site:facebook.com "Your name here"

Why is this problematic? Well, I have set my Facebook profile to not be enabled for public search. Hence, my Facebook profile does not show up in Google's search results.

But click the "Like" button on a Facebook page and you'll get indexed for liking it. As an example I've liked one of the pages owned by the Norwegian privacy authority (The Data Inspectorate) slettmeg.no. This is what Google tells me:

This behaviour is counter-intuitive and should be changed. I found a (bad) explanation to this, under the "Connecting on Facebook" section in the privacy settings, where my likes are set to be public to "Everyone." One would expect these settings to only apply to users on Facebook, not to affect how search engines would index my FB-presence.

But is this really a bug? According to the Facebook Privacy Guide, the Search section:

Public search on the Apps and Websites page controls whether people who enter your name in a search engine will see a preview of your Facebook Profile. It also controls whether things you've specifically chosen to share with everyone show up in searches on and off Facebook.

I think we can safely declare this a bug. I have sent the issue to the Facebook team, hopefully they'll make the necessary changes.

The workaround? I've obviously narrowed down who can see my "Likes, activites and other connections."

As a final note, I also have to give Facebook some credit. After searching the help center, I quickly found a dedicated page where privacy bugs can be submitted: http://www.facebook.com/help/contact.php?show_form=updated_privacy_bug. Kudos for that!