In January, Radboud University and IMDEA Networks researchers exposed Meta and Yandex’s secret Android web browsing user tracking behavior while in incognito mode by bypassing Google’s default privacy protection without consent, according to Sky News.
Assistant professor at Radboud University, Dr. Gunes Acar, said the “covert” data activity was first detected in January, where he discovered that apps like Facebook, Instagram, and Yandex Maps were doing covert data collection scripts on Android’s loading browsing activity, including in incognito mode and feeding it back to the apps.
“They are bridging these two worlds that we think are separate; web browsing and mobile app activities,” Dr. Acar told Sky News, “That’s very shocking.”
Along with Dr. Acar, academics found out that these tracking scripts were disabling Android’s built-in security and privacy measures, effectively ending user protection.
Associate professor at IMDEA Networks Narseo Vallina-Rodriguez, said to Sky News, “It’s really concerning because it negates every privacy control that you have in modern browsers and also in modern mobile platforms like Android.”
Meta Responds, Google Confirms the Data Privacy Breach
Android-parent, Google, confirmed to Sky News about the Android track user activity that both Meta and Yandex had exploited system features that “in unintended ways that blatantly violate our security and privacy principles.”
The tech giant did not elaborate on whether penalties would follow user tracking incidents.
On the other hand, Meta claimed it was unaware of any Facebook user tracker policy violations and is working with Google to address the matter.
“We are in discussions with Google to address a potential miscommunication regarding the application of their policies,” said a Meta spokesperson.
“Upon becoming aware of the concerns, we decided to pause the feature while we work with Google to resolve the issue.”
Yandex denied any allegations, claiming that “the feature in question does not collect any sensitive information and is solely intended to improve personalization within our apps.”
The company also insisted it complies with data protection standards.
Privacy Violations’ Continuous Pattern
The breach reinforces criticism of Meta’s ongoing history of tracking user activity in web application, and many other scandals. Despite repeated scandals and regulatory scrutiny, the company continues to face allegations of unethical data practices often without facing any consequences.
Dr. Acar emphasized that users were completely unaware their web activity was being monitored by apps they weren’t actively using.
While Meta insists that the feature has been temporarily put aside since it has been doing it for the past eight months while Yandex 2017, the root problem suggests the ongoing toxic cycle of user behavior tracking that isn’t being able to be broken. The company, already under global spotlight for how it deals with data, is now accused of getting on another level of privacy protection.
“We found that Facebook was doing it on roughly 16,000 websites when visited from the EU, […] Yandex was doing this on 1,300 websites,” said Tim Vlummens, a PHD student at KU Leuven that worked on the research.
US regulators have hit Meta with fines and initiated investigations, but Facebook’s parent company has successfully absorbed these with little change to its own behavior. Unless there is a complete transformation like stricter legislation, stricter enforcement, or effective antitrust measures, it’s likely Meta will once again be able to do as it wants with little actual consequence or perhaps none. While users wrestle with user tracking, which erases online privacy and the need for better surveillance technology and action has never been more urgent.
Inside Telecom provides you with an extensive list of content covering all aspects of the tech industry. Keep an eye on our Cybersecurity sections to stay informed and up-to-date with our daily articles.