Facebook sued for allegedly spying on users via in-app web browser

Facebook on laptop
(Image credit: Luca Sammarco/Pexels)

Meta is being sued for allegedly gathering personally identifiable information (PII) on its Facebook and Instagram users without telling them. 

As per the lawsuit, the problem lies in how the company's Facebook and Instagram platforms handle internet links on an iOS device. Both apps have their own embedded internet browsers, the WKWebView, which render the pages when a user clicks on a link (as opposed to opening the links in, say, Safari, or Chrome).

On the user’s side, clicking a link would make it seem as if the app opened the page, rather than as if it was opened in a separate app. However, the plaintiffs say that the browser also injects JavaScript code that gathers data - something other browsers wouldn’t be able to do.

Personally identifiable information

"When users click on a link within the Facebook app, Meta automatically directs them to the in-app browser it is monitoring instead of the smartphone’s default browser, without telling users that this is happening or they are being tracked," the lawsuit says.

"The user information Meta intercepts, monitors and records includes personally identifiable information, private health details, text entries, and other sensitive confidential facts."

The case was boosted by previous findings from cybersecurity researcher Felix Krause, who raised the issue in August 2022.

When Krause published his findings, Meta responded by saying the code injection was done to respect user privacy choices.

"We intentionally developed this code to honor people's App Tracking Transparency (ATT) choices on our platforms," a Meta spokesperson told The Register. "The code allows us to aggregate data before it is used for targeted advertising or measurement purposes."

The plaintiffs, Gabriele Willis and Kerreisha Davis, do not dispute Apple’s data gathering practices, just the fact that it kept quiet about it. 

"Meta fails to disclose the consequences of browsing, navigating, and communicating with third-party websites from within Facebook’s in-app browser – namely, that doing so overrides their default browser’s privacy settings, which users rely on to block and prevent tracking," it says in the complaint. 

"Similarly, Meta conceals the fact that it injects JavaScript that alters external third-party websites so that it can intercept, track, and record data that it otherwise could not access."

The company rejected the claims, with a spokesperson saying: “These allegations are without merit and we will defend ourselves vigorously."

"We have carefully designed our in-app browser to respect users' privacy choices, including how data may be used for ads."

Via: The Register

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
Outdoor photograph of a pair of hands holding a smartphone with navigator location points in the background
Millions of phone location records feared leaked as one of the biggest data leaks ever may be a whole lot worse
In this photo illustration, the business and employment-oriented network and platform owned by Microsoft, LinkedIn, logo seen displayed on a smartphone with an Artificial intelligence (AI) chip and symbol in the background.
LinkedIn facing lawsuit over accusations private messages used to train AI
A man holds a smartphone iPhone screen showing various social media apps including YouTube, TikTok, Facebook, Threads, Instagram and X
Which apps were most hungry for your data in 2024?
Zuckerberg Meta AI
Meta purportedly trained its AI on more than 80TB of pirated content and then open-sourced Llama for the greater good
Fingerprint
Profit over privacy? Google gives advertisers more personal info in major ‘fingerprinting’ U-turn
Conceptual image with a bunch of floating eyeballs in different sizes overlooking a red computer, could symbolize ideas around malware and computer viruses
Accept all or bust: how cookie walls are creating a two-tier internet
Latest in Software & Services
Windows 11 Start menu layout choices: Grid view
Windows 11 vs Linux for business: which operating system should you embrace?
A phone sitting on a laptop keyboard with the Microsoft Outlook logo on the screen.
Gmail vs Outlook for business: which email system is right for your organization?
Windows 11 logo
Windows 11 Pro vs Windows 11 Home: which version is right for you?
Canva HubSpot
HubSpot and Canva team up to level the creative playing field
a laptop computer
Windows 11 vs ChromeOS for business: Is one better than the other for your needs?
a laptop computer
Windows 11 vs macOS for business: which side are you on?
Latest in News
Apple's Craig Federighi demonstrates the iPhone Mirroring feature of macOS Sequoia at the Worldwide Developers Conference (WWDC) 2024.
Report: iOS 19 and macOS 16 could mark their biggest design overhaul in years – and we have one request
Google Gemini Calendar
Gemini is coming to Google Calendar, here’s how it will work and how to try it now
Lego Mario Kart – Mario & Standard Kart set on a shelf.
Lego just celebrated Mario Day in the best way possible, with an incredible Mario Kart set that's up for preorder now
TCL QM7K TV on orange background
TCL’s big, bright new mid-range mini-LED TVs have built-in Bang & Olufsen sound
Apple iPhone 16e
Which affordable phone wins the mid-range race: the iPhone 16e, Nothing 3a, or Samsung Galaxy A56? Our latest podcast tells all
An image of a Jackbox Games Party Pack
Jackbox games is coming to smart TVs in mid-2025, and I can’t wait to be reunited with one of my favorite party video games