The Belgian data protection agency commissioned a report, released this week, looking into Facebook’s privacy practices in the European Union after an initial report found the site in violation of the EU’s data and privacy laws. However, the findings of the group’s second report are even more troubling. The researchers behind the study claim that Facebook tracks all visitors to the site whether or not they are registered users. They also claim that the site tracks users’ computers without their consent and even tracks them if they have explicitly opted out in Europe.

How does the site follow so many users like this? When people visit a page with a Facebook social plug-in, such as a “Like” button, it detects users and sends tracking cookies back to Facebook. Researchers also discovered a tracking cookie that follows European Facebook users for two years after they opt out of the site’s data policy. According to the report, the site must obtain consent from users in order to track them like this.

“European legislation is really quite clear on this point. To be legally valid, an individual’s consent towards online behavioural advertising must be opt-in,” said Brendan Van Alsenoy, a co-author of the report. “Facebook cannot rely on users’ inaction (i.e., not opting out through a third-party website) to infer consent. As far as non-users are concerned, Facebook really has no legal basis whatsoever to justify its current tracking practices.”

Facebook responded to the report by saying that it contained “factual inaccuracies,” and that the Belgian agency that commissioned the report will not meet with them to discuss it.