The technical details are simple.<p>When you are &quot;logged in&quot; to Facebook, your browser stores a unique token in a cookie that can identify you. That unique token is sent with <i>every request</i> the browser sends to FB, even requests you don&#x27;t initiate directly.<p>These hidden requests happen all the time, like when a web developer embeds a FB like button on a page. The like button is actually generated and served by FB&#x27;s servers (check your browser&#x27;s dev console), and the request to show the button itself gets that cookie sent along with it regardless of whether you press it.<p>The tricky bit is that &quot;logging out&quot; might not actually be enough. I don&#x27;t use FB so can&#x27;t say for sure, but it is certainly possible to implement &quot;log out&quot; such that you can&#x27;t see restricted resources or pages, but still have an identifying cookie on your machine. In this case the cookie itself would store a flag marking you as &quot;logged in&quot; or &quot;logged out&quot;, but the cookie would still identify you all the same.