Instagram may be tracking your online activity, researcher claims

Most of the apps use the Safari- default browser on iOS to open third-party links. Facebook and Instagram, however, do not direct them to their default browser. Instead, they use custom in-app browsers when users visit webpages by clicking on a link in the iOS app. This allows the host app (Instagram and Facebook) to be able to ‘track every single interaction with external websites, from all form inputs like passwords and addresses, to every single tap.’

These apps, the researcher says, inject “their JavaScript code into every website shown, including when clicking on ads. Even though pcm.js doesn’t do this, injecting custom scripts into third party websites allows them to monitor all user interactions, like every button & link tapped, text selections, screenshots, as well as any form inputs, like passwords, addresses and credit card numbers.”

What is more concerning is that all this is happening without the consent of the user and the website provider, the researcher says. However, the researcher can not confirm whether or not Meta-owned Facebook and Instagram have gathered users’ data or not.

Apple actively works against cross-host tracking. With the iOS 14.5’s App Tracking Transparency feature, the company put the user in control. The feature requires apps to get the user’s permission before tracking their data across apps. Apple Safari is said to currently block third party cookies by default.

First article