META TRACKS ANDROID USERS WITHOUT CONSENT

Meta has been covertly tracking Android users' web browsing activity through its Facebook and Instagram apps without their consent, according to researchers at Radboud University and IMDEA Networks. The tracking involves apps collecting data from websites visited on Android devices.

- 

RESEARCH FINDINGS

Assistant professor Gunes Acar at Radboud University reported that Meta's Facebook and Instagram apps operated in the background of Android devices, loading a script that sent browsing data back to the apps. The tracking occurred on approximately 16,000 websites when visited from the European Union, using the Meta Pixel tracker embedded on these sites. The method enabled Meta to link users' browsing history to their Facebook and Instagram profiles, bypassing Android's security protections, including incognito mode and virtual private networks.

The discovery was made by a team including Acar and PhD student Tim Vlummens from KU Leuven, who noted that Meta's tracking had been active for about eight months. Google, the owner of the Android operating system, confirmed the activity, describing it as a violation of its security and privacy principles. As of June 3, Meta's Pixel script stopped sending data to the apps following the researchers' disclosure.

TRACKING MECHANISM

The Meta Pixel, a code present on roughly 20% of popular websites, facilitated the tracking by sending browsing data to the Facebook and Instagram apps via local ports on Android devices. When users visited these websites, the apps received data through fixed TCP ports and UDP ports, transmitting it to Meta's servers as a GraphQL mutation. This allowed Meta to deanonymize users, even when using incognito mode or VPNs, linking web visits to their profiles.