Meta can track users through its Facebook and Instagram in-app browsers

midian182

Posts: 8,303   +103
Staff member
A hot potato: Facebook has never boasted a reputation for protecting its users' privacy. Now, an ex-Google engineer writes that both the social network and another Meta-owned property, Instagram, are using their in-app browsers to track users by injecting code into websites.

Researcher Felix Krause looked into how Facebook and Instagram use custom in-app browsers when users visit webpages by clicking on a link; the apps don't redirect users to their default browser.

"The Instagram app injects their tracking code into every website shown, including when clicking on ads, enabling them [to] monitor all user interactions," Krause writes.

The researcher investigated the iOS versions of Meta's apps. That's especially relevant as Apple's App Tracking Transparency (ATT) feature introduced in iOS 14 allows users to prevent apps from tracking their activities across other companies' apps and websites. At last count, 96% of those using iOS 14.5 were not enabling in-app tracking.

Meta said that it only injected tracking code based on a user's ATT preferences and that it was only used to aggregate data before being applied for targeted advertising or measurement purposes for those users who opted out of such tracking, writes The Guardian.

"We do not add any pixels," said a Meta spokesperson. "Code is injected so that we can aggregate conversion events from pixels. For purchases made through the in-app browser, we seek user consent to save payment information for the purposes of autofill."

Krause notes that while injecting custom scripts into third-party websites, a practice usually associated with cyberattacks, does allow the monitoring of sensitive information such as passwords, addresses, and credit card numbers, there is no suggestion Meta is surreptitiously collecting this data. Meta did add, however, that "for purchases made through the in-app browser, we seek user consent to save payment information for the purposes of autofill."

The researcher added that the technique works for any website, whether encrypted or not, and it isn't present in WhatsApp. If you want to avoid the tracking, Krause says to use the option that opens the currently viewed website in a browser such as Chrome or Safari. Alternatively, use the mobile web version of the social networks rather than their apps.

Meta previously warned that ATT would negatively impact developers and advertisers. Facebook, Snapchat, Twitter, and YouTube lost a combined $9.85 billion in the two quarters following ATT's implementation. Meta said it resulted in $10 billion in lost revenue and a 26% fall in the company's share price earlier this year.

Permalink to story.

 

psycros

Posts: 4,448   +6,631
Is there anything that this sleezy company won't do? Seriously people, walk the f**k away from Facebook already; they're a disease.

Chrome collects all your personal login data even when you specifically tell it not to. When you get that "privacy report" showing you all of your passwords that may have been compromised you'll understand how vile Google is.
 

trparky

Posts: 1,142   +1,305
Chrome collects all your personal login data even when you specifically tell it not to. When you get that "privacy report" showing you all of your passwords that may have been compromised you'll understand how vile Google is.
I don't use Chrome, I use Edge.
 

bviktor

Posts: 1,042   +1,519
Funny, but it's not really like that. Chrome without Google = Chromium. That's what Edge is built upon. So Google won't track you outside their sites - MS will.

But yeah, you just have to pick your poison. I prefer MS to be tracking me. Why? Because they don't live off personal data (ads).

I'm also using Firefox. Edge is usually only for YouTube, coz recently FF is having issues with it, prolly because of adblock. But I just refuse to listen to my govt's constant propaganda in the YT ads.

In any case, I certainly recommend everyone to use Privacy Badger from the EFF:

https://privacybadger.org/

It helps out a little.
 

m4a4

Posts: 3,082   +4,120
TechSpot Elite
Funny, but it's not really like that. Chrome without Google = Chromium. That's what Edge is built upon. So Google won't track you outside their sites - MS will.

But yeah, you just have to pick your poison. I prefer MS to be tracking me. Why? Because they don't live off personal data (ads).

I'm also using Firefox. Edge is usually only for YouTube, coz recently FF is having issues with it, prolly because of adblock. But I just refuse to listen to my govt's constant propaganda in the YT ads.

In any case, I certainly recommend everyone to use Privacy Badger from the EFF:

https://privacybadger.org/

It helps out a little.
FF is having issues with YT? Haven't noticed, even with adblock (which I setup to be selective based on the channel I watch).
 

m4a4

Posts: 3,082   +4,120
TechSpot Elite
I mean, is anyone surprised? It's an in-app browser, I expect it to be tailored to tracking you when you click on a link.

And that's why I only really use desktop browsers with social media (where I can heavily customize my FB experience).
 

Hodor

Posts: 230   +160
Google is the biggest spying operation on the planet Earth. Actually, biggest in our solar system. Facebook are little kids compared to Google. Even NSA are preschool kids compared to Google.