Doesn't that social graph require them to know what you're doing on a given site?

I suppose they already have that power, otherwise we wouldn't have what you describe.

But the article says they're only gathering connection metadata, this law anyway. I guess they're already doing even more intrusive things, at least as a way to know who to get "legit" evidence on.