Facebook has caved to users by announcing a new privacy control to allow users to turn off the controversial Beacon advertising system.

The social-networking site had come under heavy criticism from users and privacy advocates after a security researcher revealed that Beacon tracked user activities on third-party partner sites. The system captures data on what users do and buy on the external sites and sends it back to Facebook. However, as well as tracking Facebook users, Beacon also tracked those who'd never signed up to Facebook and those who deactivated their accounts.

However, in a blog post, Facebook founder and CEO Mark Zuckerberg said, "We simply did a bad job with this release, and I apologise for it. We've made a lot of mistakes building this feature, but we've made even more with how we've handled them."

The first goal when building Beacon, Zuckerberg said, was to build a "simple product to let people share information across the sites with their friends."

The company first tried to make the system lightweight so people wouldn't have to touch it for it to work, he said. However, making it an opt-out system instead of an opt-in system didn't work, because "if someone forgot to decline to share something, Beacon still went ahead and shared it with their friends," he said.

"It took us too long after people started contacting us to change the product so that users had to explicitly approve what they wanted to share," he added. "Instead of acting quickly, we took too long to decide on the right solution. I'm not proud of the way we've handled this situation and I know we can do better. People need to be able to explicitly choose what they share, and they need to be able to turn Beacon off completely if they don't want to use it."

Just after the announcement, some Facebook users questioned whether the move is enough to alleviate their privacy concerns.

In an online Facebook forum dedicated to privacy protests over Beacon, user Rob Tandry said he is concerned that the action may simply be a red herring.

"On the opt-out page, it says that you will stop information from being posted to your profile," he noted. "It does not explicitly state that Facebook will stop collecting the information transmitted from third-party sites."

Facebook user Tom Hessman added that Zuckerberg admitted that Facebook will still be receiving data from partner sites whether users opt out or not. "From the sound of it, everything still works as is, except that on the Facebook end you can opt to never have [information about activities on other sites] publish. And if you do, supposedly they purge the data. But with the way Beacon works, the data could still very well exist in Facebook's standard web server logs ... do they purge those too?"

Meanwhile, user Paulette Altmaier noted on the forum that "It's much too early to declare victory. It's not in our interests to have our personally identifiable information aggregated by anyone. An opt-out from publishing is not enough - we want an opt-out from affiliate sites sending anything to Facebook," she wrote.

Some of the privacy experts who have been criticising Facebook about the intrusiveness of Beacon, said that the company is still not doing enough to protect its users from data collection.

Jeff Chester, executive director of the Center for Digital Democracy, said that "Beacon is just one aspect of a massive data collection and targeting system put into place by Facebook. Mr. Zuckerberg's goal, as he explained it on 6 November, 2007 was to transform it into 'a completely new way of advertising online.' [He] can't simply now do a digital 'mea culpa' and hope that Facebook's disapproving members, privacy advocates and government regulators will disappear."

Nonetheless, Chester did call the move to provide a global opt out option "a step in the right direction."