Meta has come under scrutiny after it was discovered that the company had been quietly tracking Android users’ online behavior, even when they were using incognito mode or a VPN. The method was recently paused, but not before it raised major concerns about user privacy.
This tracking method was brought to light by Professor Günes Acar of Radboud University. His research revealed that Meta was collecting private browsing data through a clever and controversial use of the Meta Pixel. Present on many popular websites, this script communicated with the Facebook and Instagram apps installed on the same Android device.
The result? Meta could record what users viewed, clicked, or purchased online, even if users believed private browsing tools protected them.
Meta’s tracking method bypassed key privacy tools. It ignored incognito mode, VPNs, and Android’s app sandboxing. Users trust these features to protect their online activity. But Meta’s hidden tracking still worked, even with them on.
The core goal of this data collection was to refine personalized advertising, aligning ads on Facebook and Instagram with the user’s most recent browsing behavior. However, the fact that this was done without consent has sparked outrage and concern.
Industry Reactions
Google has since acknowledged that Meta’s method clashed with its security and privacy principles. In response, it is working on Chrome patches to block such tracking in the future. Mozilla, too, is preparing a fix for Firefox.
Meta, on the other hand, described the practice as an “issue” and claimed it is now cooperating with Google to resolve it, though it has yet to explain why user consent was never part of the process.
Since the tracking only affected Android users, the incident raises a broader question: Are iPhones more secure than Androids? With privacy becoming a major concern, this revelation may influence how users choose their devices moving forward.
Meta may have paused the practice, but the incident serves as a wake-up call about how easily privacy promises can be bypassed. When even “incognito” isn’t safe, what can users truly rely on?
