The main point here is that Google isn't doing anything with the "Facebook data" that the original user of that data (who actually owns it, let's be fair about that) hasn't approved of in one way or another.

If I go to http://graph.facebook.com/<myusername>, the only data that is visible is:

  {
    "id": "...",
    "name": "...",
    "first_name": "...",
    "last_name": "...",
    "username": "...",
    "gender": "male",
    "locale": "en_US"
  }

Friends can be accessed similarly, but require an access token (_any_ access token, not just the user's that you're inspecting.

More details at Facebook's API docs: https://developers.facebook.com/docs/reference/api/user/

This would seem to be a bug if so, according to this page in the FB documentation: To get additional information about a user, you must first get their permission. At a high level, you need to get an access token for the Facebook user. After you obtain the access token for the user, you can perform authorized requests on behalf of that user by including the access token in your Graph API requests:

https://developers.facebook.com/docs/reference/api/

That's my list of the first 50 people who joined Facebook, using the Graph API & a bit of Java. Look for Saverin, Zuckerberg, Moskovitz & rest of the gang. Its all in there!

Wrote this to find the first million facebook signons.

curl https://socialgraph.googleapis.com/otherme?q=<yourgmaila...

Here's what they have to say about me, to anybody with a web browser, even though I've tried my hardest to opt out:

https://socialgraph.googleapis.com/otherme?q=facebook.com/km...

{"http://twitter.com/keithmadams:{attributes:{atom:http://twit... at Facebook, dad, cyclist.","exists":"1","rss":"http://twitter.com/statuses/user_timeline/keithmadams.rss,ur...},"http://www.quora.com/keith-adams:{attributes:{exists:1,photo... Adams","url":"http://www.quora.com/keith-adams,profile:http://www.quora.co...

My understanding from Google's description above is that they are scraping the logged out facebook.com profiles; your logged out profile has a random selection of friends on it. There are enough of them there for Google to infer that facebook.com/kma (me, who is friends with Nick Schrock, e.g.) is the same Keith Adams as kmadams_at_gmail_dot_com (also me, who also has written emails to someone named Nick Schrock). Without clicking through anything on either site, I started getting little faces in my search results last month saying "So-And-So, your friend on Facebook, shared this on Twitter."

Here's a screenshot of the results I was seeing:

http://imgur.com/0ctAO

Disclosure: I write code for Facebook. I had nothing to do with this whole thing, and cannot officially speak for FB. It could also be the case that I am in a A/B test Google is performing, etc. This was just my experience. It fits with Google's stated mechanisms for how Social Circles work.

I've never heard of that, just easy ones like twitter accounts (which, by the way, required both notification and permission when google asked if it was me and if I wanted my twitter account to be associated with my google profile).