{"id":305369,"date":"2025-06-04T01:37:12","date_gmt":"2025-06-04T08:37:12","guid":{"rendered":"https:\/\/cms-articles.softonic.io\/en\/?p=305369"},"modified":"2025-07-01T14:29:27","modified_gmt":"2025-07-01T21:29:27","slug":"meta-was-secretly-tracking-browsing-history-even-with-vpn-use-whats-going-on","status":"publish","type":"post","link":"https:\/\/cms-articles.softonic.io\/en\/meta-was-secretly-tracking-browsing-history-even-with-vpn-use-whats-going-on\/","title":{"rendered":"Meta was secretly tracking browsing history even with VPN use: What\u2019s going on?"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Meta is once again under scrutiny after researchers uncovered a&nbsp;<strong>serious privacy breach involving Facebook and Instagram apps on Android devices<\/strong>. Even when users employed&nbsp;<strong>VPNs or incognito mode<\/strong>, the company was still able to&nbsp;<strong>track their web browsing history without consent<\/strong>, prompting outrage and renewed concerns about digital surveillance.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Apps exploited local ports to bypass Android privacy protections<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The discovery was made by&nbsp;<strong>G\u00fcnes Acar, a privacy expert at Radboud University<\/strong>, during a lecture on web tracking. Unexpected local port activity led to the revelation that&nbsp;<strong>Facebook and Instagram apps were silently listening on users&#8217; local ports<\/strong>, collecting data from their web activity. When cross-checked with Narseo Vallina-Rodr\u00edguez from Imdea Networks, the findings confirmed that&nbsp;<strong>Meta was linking web sessions with identity cookies<\/strong>, effectively bypassing Android\u2019s privacy safeguards.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Meta Pixel and identity cookies exposed users\u2019 real activity<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">At the heart of this tracking system was Meta Pixel\u2014a small piece of code embedded in websites that, when combined with an active Facebook or Instagram session, could&nbsp;<strong>tie anonymous browsing data to a real user profile<\/strong>. This allowed Meta to collect detailed logs including&nbsp;<strong>visited pages, search actions, and even online purchases<\/strong>, all routed directly to its servers.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Meta disables the feature after backlash<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">After the findings were made public, Meta confirmed that it&nbsp;<strong>disabled the tracking mechanism<\/strong>, which had been in place since September 2024. The vulnerability affected&nbsp;<strong>major Android browsers like Chrome, Firefox, DuckDuckGo, and Edge<\/strong>, pushing browser developers like Google and Mozilla to prepare security patches. Meta is reportedly in discussions with Google to clarify the enforcement of its app policies.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Meta is once again under scrutiny after researchers uncovered a&nbsp;serious privacy breach involving Facebook and Instagram apps on Android devices. Even when users employed&nbsp;VPNs or incognito mode, the company was still able to&nbsp;track their web browsing history without consent, prompting outrage and renewed concerns about digital surveillance. Apps exploited local ports to bypass Android privacy &hellip; <a href=\"https:\/\/cms-articles.softonic.io\/en\/meta-was-secretly-tracking-browsing-history-even-with-vpn-use-whats-going-on\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Meta was secretly tracking browsing history even with VPN use: What\u2019s going on?&#8221;<\/span><\/a><\/p>\n","protected":false},"author":9317,"featured_media":305371,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wpcf-pageviews":0},"categories":[1015],"tags":[],"usertag":[],"vertical":[],"content-category":[],"class_list":["post-305369","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/305369","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/users\/9317"}],"replies":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/comments?post=305369"}],"version-history":[{"count":1,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/305369\/revisions"}],"predecessor-version":[{"id":305372,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/305369\/revisions\/305372"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/media\/305371"}],"wp:attachment":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/media?parent=305369"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/categories?post=305369"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/tags?post=305369"},{"taxonomy":"usertag","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/usertag?post=305369"},{"taxonomy":"vertical","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/vertical?post=305369"},{"taxonomy":"content-category","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/content-category?post=305369"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}