Skip to content
Search

Localhost tracking

lastmod 2025-06-11created 2025-06-111 edits

Meta's "localhost tracking" technique

  • Through an innovative but highly controversial technique called “localhost tracking”, Meta bypassed the user identification protections that the Android sandbox system deliberately blocks
  • The Facebook/Instagram apps open specific TCP/UDP ports on the phone in the background and keep them in a "listening" state (login required)
  • When the user visits a website (e.g., news, shopping) in a browser on the same device, if the site has Meta Pixel installed, cookies and activity information are collected immediately
    • Privacy measures such as VPNs, incognito mode, and clearing cookies have no effect
  • The Meta Pixel script in the browser uses WebRTC (originally for video/voice communication) and a trick called SDP Munging to send the _fbp cookie directly to the app
  • At the same time it separately sends the same information to Meta's servers, enabling two-way linked tracking online and offline
  • The Facebook/Instagram app receives the _fbp value and sends it back to Meta's GraphQL server along with the account's unique identifier
    • As a result, web browser visit IDs and actual Facebook/Instagram user accounts are strongly bound together, mapping web browsing activity to real identities 1:1

Why the problem is serious

  • Circumvents, through a loophole, the local port listening/covert inter-app communication that Android's design prohibits
  • Defenses such as VPNs, incognito mode, and clearing cookies are useless, even if the user doesn't open the app or isn't logged in on the web browser
  • Collects and links information without the clear and sufficient prior consent required for compliance with privacy regulations such as GDPR
  • 22% of the world's top sites affected; billions of people tracked without consent over 9 months (Meta)/8 years (Yandex)
  • Information collected and combined: full browsing history, shopping carts and purchase history, website form entries, behavior patterns by time of day, linkage to real-name accounts, etc.
  • Only exceptions: using iOS or a PC, not having the apps installed, or using only Brave/DuckDuckGo browsers

See also

Favorite site

author Zer0 sitemap