If you visit a website that you see on Facebook and Instagram, you may notice that you are not redirected to your browser of choice but to a custom in-app browser. It turns out that those browsers inject javascript code into every web page visited, giving the parent Meta the ability to track you across websites, researchers say. Felix Krause Discovered.
“The Instagram app injects their tracking code into every web page displayed, including when an ad is clicked, allowing them to [to] track all user interactions, like every button and link pressed, text selections, screenshots, as well as any form inputs, like passwords, addresses, and credit card numbers use,” Krause said in a blog post.
His research focuses on the iOS versions of Facebook and Instagram. That’s key because Apple allows users to opt in or out of an app when they first open it, through Transparency of App Tracking (ATT) was introduced in iOS 14.5. Meta yes previously said that the feature is “a big windfall in our business in 2022 … with $10 billion in orders.”
Meta says that the tracking code included is subject to user preferences on ATT. “The code allows us to aggregate user data before using it for targeted advertising or measurement purposes,” a spokesperson said. Guardians. “We don’t add any pixels. Code is included so we can aggregate conversion events from the pixel. For purchases made through the in-app browser, we search user consent to save payment information for autofill purposes.”
Krause notes that Facebook doesn’t necessarily use javascript to collect sensitive data. However, if the apps open the user’s preferred browser like Safari or Firefox, there’s no way to do the same javascript injection on any secure web page. In contrast, the approach used by browsers in the Instagram and Facebook apps “fits any website, regardless of whether it’s encrypted,” he said.
According to Krause’s research, WhatsApp does not modify third-party websites in the same way. Therefore, he suggests that Meta should do the same with Facebook and Instagram, or just use Safari or another browser to open the link. “It’s the best thing for the user and the right thing to do.” For more, see a summary of his findings here.
All products recommended by Engadget are curated by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.
