A stir has erupted after it was revealed that popular apps like Facebook and Instagram, both owned by Meta, were accessing the web history of users with Android devices. without their express consent. In recent weeks, the tech world has been shocked by the revelation of a system that allowed these apps to track internet activity, even if the user was browsing in incognito mode or using a VPN.
Both privacy specialists and regular social media users have been impacted. due to the complexity and discretion of the method found, which has called into question the effectiveness of current privacy barriers.
How did Meta manage to follow Android users?
The origin of the investigation starts from an unusual observation Conducted by Günes Acar, a professor at Radboud University (Netherlands), along with his team and in collaboration with Spanish researcher Narseo Vallina-RodrÃguez of Imdea Networks. Their technical analysis revealed that since September 2024, Instagram and Facebook on Android have been using a system capable of linking data between the mobile browser and the app installed on the device.
The key was in the Meta Pixel, A snippet of code present on nearly 20% of the world's most popular websites. When a user visited one of these pages and had the Facebook or Instagram app open, a local connection was established that allowed the user's real identity to be associated with their browsing history and actions performed on those pages: forms, searches, online purchases, and more.
The method was so sophisticated that it was able to bypass barriers such as the browser's incognito mode or VPNs, that were supposed to hide user activity. Researchers noted that this system went undetected for months, until a detailed analysis revealed irregular connections between the website and the app.
Meta and Google's reaction to the discovery
Following the great stir generated, Meta decided to disable the tracking function On June 3, following questions from several international media outlets, the company argued in a statement that the tool was paused pending clarification of technical issues with Google and to address potential misunderstandings regarding the interpretation of Android's privacy policies.
On Google's part, the response was not long in coming. The company that owns Android and the Chrome browser called the mechanism a serious violation of privacy regulations. Google has launched its own investigation and is already implementing additional measures in Chrome to close any loopholes that allow this type of practice, extending the privacy enhancements to other browsers such as Firefox, Edge, and DuckDuckGo.
Some experts suggest that Meta's move could be a response to the implementation of the Privacy Sandbox, Google's strategy to limit the use of third-party cookies and strengthen user data protection, although this hypothesis has not been officially confirmed by either party.
This case highlights the increasing sophistication of digital tracking mechanisms and the difficulty for users, manufacturers, and regulators alike in anticipating and blocking new forms of tracking on mobile devices. This situation demonstrates the importance of maintaining vigilance over how personal data is managed in the Android ecosystem and serves as a reminder that, despite regulatory and technological efforts, protecting digital privacy continues to face new challenges.
