An article in Computerworld explains that Facebook’s Beacon javascript, once incorporated in a partner site, collects information on activities of all users with a Facebook cookie, not just logged in Facebook members. A Facebook spokesman stated that data from opt-ed out Facebook members and others is automatically discarded.

From the article:

On Thursday night, Facebook tweaked Beacon to make its workings more explicit to Facebook users, and to make it easier to nix broadcast messages and opt out of having activities tracked on specific Web sites. Facebook didn’t go all the way to providing a general opt-out option for the entire Beacon program, as some had hoped.

Then on Friday, just hours after Facebook had scored some points with its modifications to Beacon, Berteau published his note about Beacon’s until-then unknown ability to monitor logged-off users’ activities and send the data back to Facebook.

Users aren’t informed that data on their activities at these sites is flowing back to Facebook, nor given the option to block that information from being transmitted, [Stefan Berteau, senior research engineer at CA’s Threat Research Group] said at the time.
If users have ever checked the option for Facebook to “remember me” — which saves users from having to log on to the site upon every return to it — Facebook can tie their activities on third-party Beacon sites directly to them, even if they’re logged off and have opted out of the broadcast. If they have never chosen this option, the information still flows back to Facebook, although without it being tied to their Facebook ID, according to Berteau.

Berteau’s colleague Benjamin Googins last week posted an article with suggestions for users who want to protect themselves from the Beacon tracking activities.