Meta injecting code into websites to track its users, research says | Meta

Skimmed the article, this appears to be an attack built into their in app browser (I wasn't aware those apps even had browsers):

The two apps have been taking advantage of the fact that users who click on links are taken to webpages in an “in-app browser”, controlled by Facebook or Instagram, rather than sent to the user’s web browser of choice, such as Safari or Firefox.

I don't use Facebook, but my interest has been piqued, probably gonna spin up a VM when I get home to check it out for myself, and if this is what it appears to be in the article it's still user tracking, but bigger.

But as far as information gathering goes, this appears to be on a whole new level. Access that doesn't rely on cookies, can easily ignore "do not track" settings and browser or website specific cookie / tracking settings, and more importantly can better live track all interactions with any website accessed thru it. Things they didn't have accurate data for or even things they previously had no access to like exactly how long you were on a site, where and how far you scrolled, if you selected or copied text or a URL, and all that's just browser specific.

They'd also be able to pair that with other data they aggregate through android / iPhone permissions, it's a lot on its own but when the two are combined it goes far beyond their previous ability. The kind of access that would make every, active or retired, living member of all the three letter agencies collectively simultaneously orgasim (maybe some dead ones too).

I assume you're probably like me and never use any in app browsers and I'm going under the assumption you also don't use Facebook, so you may be led to believe we would remain unaffected. This was already incorrect, but potentially even more so now. By merging the access to the phone, app, and now browser it would greatly elevate their ability to gather data on non-users from the users data combined interactions with the non-users.

It's also a clever way for them to bypass web tracking restrictions and laws by disguising web tracking as "in app" tracking granting further access in countries where website tracking is better regulated.

Tldr; Yes, data aggregation isn't new, but comparing the old and the new methods has the potential to be like comparing a BB to an anti-tank round.

/r/news Thread Parent Link - theguardian.com