Facebook user Sean Lane bought a special gift for his wife. But his secret plans were ruined when information about his purchase was published through the social-networking site’s new advertising system, Beacon.

Stories such as this have many users concerned about their privacy. Last week, Facebook founder Mark Zuckerberg issued an apology and released a control that lets users turn off the system. But last weekend, experts at Yale Law School’s symposium on reputation economies in cyberspace said that Facebook’s privacy woes may not be over.

Beacon works by making use of partnerships that Facebook has formed with other websites, including Blockbuster and the New York Times. When users visit those sites and take certain actions, such as buying something or putting an item on a wish list, those sites send information about that activity to Facebook. The social-networking site then publishes the information on the user’s profile page and notifies the user’s friends via a news feed (a list that each user sees upon logging in to Facebook that gives information about his or her friends’ recent activities). Beacon’s original design required users to explicitly opt out each time they did not want information shared. “Engaging with businesses and buying things are part of your everyday life,” wrote Leah Pearlman, product manager for Facebook Ads, in a company blog posting. She went on to describe how Facebook’s advertising strategy centers around having users share consumer information along with the rest of what is shared on the social network.

Privacy concerns surfaced shortly after Beacon launched a month ago, prompting the activist group MoveOn, for example, to start a Facebook group protesting Beacon and to organize an online petition. Lane joined MoveOn because he was upset that his purchasing information was shared with friends. Other group members worried about the type of information that Facebook was collecting about their activities. The firestorm led Zuckerberg to apologize, saying, “I’m not proud of the way we’ve handled this situation and I know we can do better.” As part of the apology, Facebook changed Beacon to an opt-in system. “Facebook’s policy change is a big step in the right direction, and we hope it begins an industry-wide trend that puts the basic rights of Internet users ahead of the wish lists of corporate advertisers,” says MoveOn’s civic-communications director Adam Green. He notes, however, that while Facebook has addressed most of the worries about data sharing, its data-collection policies are of ongoing concern to some.

William McGeveran, an associate professor at the University of Minnesota Law School, who researches digital identity and data privacy, says that he believes systems like Beacon will cause increasing tension by drawing attention to the data mining that companies are already doing.

Alessandro Acquisti, an assistant professor of information technology and public policy at Carnegie Mellon University, says that Facebook’s changes may not give users increased privacy in the end. Although users have become more educated about how to use privacy controls, he says, “there is power in default settings.” Many people might show concern but never bother to change settings to protect their privacy.

Acquisti remembers that Facebook weathered a similar storm when its news-feed feature was released, although the news feed was not an advertising tool at first. People worried about their activities being broadcast, but in the end, Acquisti says, they adapted. As news feed became an accepted part of Facebook, people grew less concerned. “They changed their attitudes after changing their behavior,” he says. It is possible, he notes, that a similar effect will take place with Beacon.

Jonathan Zittrain, cofounder of the Berkman Center for Internet and Society, says that in the absence of laws and technologies to specifically protect users’ privacy, companies such as Facebook and Google will be increasingly called upon to regulate themselves. These Web services are in a position to govern how things built on their platforms should work, Zittrain says: “It’s a level of control Bill Gates never dreamed of for Windows.”