The way I understand it, if you have the "instant personalization" feature On (and it is by default), when you visit an enabled site, they can request your personal/non-public information to give a better experience. If you turn that feature off, they can only access your public info ... Pages and whatever else you leave open. Again, all this stuff is public by default.

I'd like to hear some backup of this theory though.

The big winner here is Facebook. Comments, likes and all that stuff all make they way back to the Facebook mothership. The external websites may or may not get access to that info.