Meta pauses mobile port tracking tech on Android after researchers cry foul
- Reference: 1748992684
- News link: https://www.theregister.co.uk/2025/06/03/meta_pauses_android_tracking_tech/
- Source link:
Following the disclosure, researchers observed that Meta's Pixel script stopped sending data to localhost and that the tracking code was largely removed. The move may help Meta avoid scrutiny under Google Play policies, which prohibit covert data collection in apps.
"We are in discussions with Google to address a potential miscommunication regarding the application of their policies," a Meta spokesperson told The Register . "Upon becoming aware of the concerns, we decided to pause the feature while we work with Google to resolve the issue."
[1]
Meta's spokesperson did not respond to a request to elaborate on the company's discussions with Google.
What the researchers found
In a [2]report published Tuesday, computer scientists affiliated with IMDEA Networks (Spain), Radboud University (The Netherlands), and KU Leuven (Belgium) describe how the US social media giant and the Russian search engine were observed using native Android apps to gather web cookie data via the device's loopback interface, commonly known as localhost.
Localhost is a loopback address that a device can use to make a network request to itself. It's commonly used by software developers to test server-based applications like websites on local hardware.
[3]
[4]
The researchers – Aniketh Girish (PhD student), Gunes Acar (Assistant Professor), Narseo Vallina-Rodriguez (Associate Professor), Nipuna Weerasekara (PhD student), and Tim Vlummens (PhD student) – say they found native Android apps, including Facebook and Instagram, and Yandex's Maps and Browser – that listen silently on fixed local ports for tracking purposes.
"These native Android apps receive browsers' metadata, cookies and commands from the Meta Pixel and Yandex Metrica scripts embedded on thousands of websites," the computer scientists explain. "These JavaScripts load on users' mobile browsers and silently connect with native apps running on the same device through localhost sockets."
[5]
As these native apps access device identifiers like the Android Advertising ID or handle user identities in Meta apps, the researchers say, they're able to link mobile browsing sessions and web cookies to user identities.
Essentially, by opening localhost ports that allow their Android apps to receive tracking data, such as cookies and browser metadata, from scripts running in mobile browsers, Meta and Yandex are able to bypass common privacy safeguards like cookie clearing, Incognito Mode, and Android's app permission system.
The technique also violates assumptions about the scope of first-party cookies, which aren't supposed to be able to track browsing activity across different websites. According to the researchers, "the method we disclose allows the linking of the different _fbp cookies to the same user, which bypasses existing protections and runs counter to user expectations."
[6]
With regard to Meta, the tracking process involves scripts associated with [7]Meta Pixel , analytics code used by marketers to gather data about interactions with websites.
Various APIs and protocols can be used to implement the described app-web eavesdropping scheme. These include: SDP munging, which involves manually modifying Session Description Protocol (SDP) messages before the data gets passed to the browser; real-time communications protocols [8]Websocket and [9]WebRTC ; Session Traversal Utilities for NAT (STUN), an address discovery mechanism; and Traversal Using Relays around NAT (TURN), a router restriction bypass method.
[10]X's new 'encrypted' XChat feature seems no more secure than the failure that came before it
[11]Meta – yep, Facebook Meta – is now a defense contractor
[12]Billions of cookies up for grabs as experts warn over session security
[13]Irish privacy watchdog OKs Meta to train AI on EU folks' posts
The researchers describe Meta's approach thus:
The user opens the native Facebook or Instagram app, which eventually is sent to the background and creates a background service to listen for incoming traffic on a TCP port (12387 or 12388) and a UDP port (the first unoccupied port in 12580-12585). Users must be logged-in with their credentials on the apps.
The user opens their browser and visits a website integrating the Meta Pixel.
At this stage, websites may ask for consent depending on the website's and visitor's locations.
The Meta Pixel script sends the [14]_fbp cookie to the native Instagram or Facebook app via WebRTC (STUN) [15]SDP Munging .
The Meta Pixel script also sends the _fbp value in a request to https://www.facebook.com/tr along with other parameters such as page URL (dl), website and browser metadata, and the [16]event type (ev) (e.g., PageView, AddToCart, Donate, Purchase).
The Facebook or Instagram apps receive the _fbp cookie from the Meta Pixel JavaScript running on the browser. The apps transmit _fbp as a GraphQL mutation to (https://graph[.]facebook[.]com/graphql) along with other persistent user identifiers, linking users' fbp ID (web visit) with their Facebook or Instagram account.
Researchers observed Meta implementing this technique starting in September 2024, transmitting data via HTTP. Third-party developers working with Meta APIs noted and questioned the behavior in [17]forum [18]posts at the time.
HTTP-based data transmission using this technique supposedly ended the following month, but other methods of transmission (WebSocket, WebRTC STUN (w/ SDP Munging), and WebRTC TURN (w/o SDP Munging)) were identified in subsequent months.
Presently, however, Meta's use of these techniques appears to have halted. According to the researchers, "As of June 3rd 7:45 CEST, Meta/Facebook Pixel script is no longer sending any packets or requests to localhost. The code responsible for sending the _fbp cookie has been almost completely removed."
Yandex's use of localhost-based tracking dates back to 2017, according to the researchers.
The Register sought to ask Yandex media relations about the researchers' claims but our inquiry was bounced as spam.
The report authors note that their disclosure to Android browser vendors has led to several mitigations.
Chrome 137, which shipped May 26, 2025, includes countermeasures [19]to block the SDP Munging technique used by Meta Pixel, though these have only been made available to a subset of users participating in a gated field trial. A fix is currently being developed for Mozilla Firefox. Brave is unaffected as it [20]requires consent for localhost use. And DuckDuckGo has modified its blocklist to stop Yandex's scripts.
Beyond these, the authors suggest a Google [21]proposal to create a new "local network access" permission that could help mitigate localhost-based tracking in the future. A [22]prior proposal along these lines ran into [23]technical barriers . ®
Get our [24]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aEAZKVOHEtX_xYHVt_a0ewAAAIA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://localmess.github.io/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aEAZKVOHEtX_xYHVt_a0ewAAAIA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aEAZKVOHEtX_xYHVt_a0ewAAAIA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aEAZKVOHEtX_xYHVt_a0ewAAAIA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aEAZKVOHEtX_xYHVt_a0ewAAAIA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.facebook.com/business/tools/meta-pixel
[8] https://developer.mozilla.org/en-US/docs/Web/API/WebSockets_API
[9] https://developer.mozilla.org/en-US/docs/Web/API/WebRTC_API/Protocols
[10] https://www.theregister.com/2025/06/03/xs_new_encrypted_xchat_feature/
[11] https://www.theregister.com/2025/05/30/meta_is_now_a_defense/
[12] https://www.theregister.com/2025/05/29/billions_of_cookies_available/
[13] https://www.theregister.com/2025/05/22/irish_data_protection_commission_gives/
[14] https://localmess.github.io/#about_fbp
[15] https://webrtchacks.com/not-a-guide-to-sdp-munging/
[16] https://web.archive.org/web/20250531104925/https://developers.facebook.com/docs/meta-pixel/reference/
[17] https://web.archive.org/web/20250531105747/https://developers.facebook.com/community/threads/317050484803752/
[18] https://web.archive.org/web/20250531105711/https://developers.facebook.com/community/threads/937149104821259/
[19] https://webrtc.googlesource.com/src.git/+/72d6d748ddbe5d7f63ba5f2dd1ce195a342c0a12
[20] https://brave.com/privacy-updates/27-localhost-permission/
[21] https://github.com/explainers-by-googlers/local-network-access
[22] https://wicg.github.io/private-network-access/
[23] https://developer.chrome.com/blog/pna-on-hold
[24] https://whitepapers.theregister.com/
Re: Meta
They will either bring it back in a month after everyone has forgotten about it or they have backup plans B, C and D to accomplish their tracking and they'll switch to one of those. That'll be good for a couple years until someone catches onto that scheme.
One rule for them
If we wrote a program that did that, being bannes by Google is the least of our problems. We'd probably be jailed for trojanised privicy violations.
Yet Meta et al. can just put it down to a "miscommunication" and get away with it. They need to be fined SERIOUS money under GDPR and the people responsible be held personally liable.
And now my browser rant. I'm fed up of all these things added to browsers to do non browsing stuff. If I'm forced to enable javascript, I don't want RTC and all sorts of shite open. I don't want to be fingerprinted by revealing my window and screen resolutions, installed fonts etc.
If any web site "legitimately" wants my window resolution, it's doing it wrong.
I've never used rtc in a browser.
I don't want the browser playing God with my DNS config.
Just render the webpage damnit!
Re: One rule for them
"I don't want the browser playing God with my DNS config."
THIS. it pisses me off *so* much how some browsers enforce their own DNS settings. I have a pi-hole i access over LAN or VPN, i don't neet DoH, stop forcing the google DNS on me because it provides "more security and privacy". Same on Android, you have to disable secure DNS or it will ignore your custom DNS settings.
I don't really have an issue with enabling DoH by default (other than Google defaulting to it's own DNS), but i do have a problem with them silently overriding my DNS settings.
Re: One rule for them
There are ways around this, although they are "not for the average user" (sadly).
I've got piHole, linked to OpenDNS - and WireGuard on my LAN which my phone accesses remotely - and you can route "0.0.0.0/0" (everything) back over it - and then just block 853 (DoT) and any unknown port 53 sites. DoH is harder but you can at least "block known hosts".
I've only seen a couple of apps try to force their own DNS - normally easy to spot as various icons break due to not loading :)
Re: One rule for them
I guess this is also a huge GDPR infrigement, but I'm sure the leprechauns at the Irish DPC are getting new Zuck gold for their pots, and will soon tell us the Meta promised to be fully GDPR compliant so everything is fine, move on.
It's a bit disconcerting that Meta fears more Google - because it can ban Meta apps immediately and easily - than EU laws.
Re: One rule for them
I guess we're not counting the €2.8 billion that the DPC has previously fined Meta, then. (They haven't collected most of it due to legal challenges, of course, but that's a whole different matter.)
Oops, caught out
"We are in discussions with Google to address a potential miscommunication regarding the application of their policies," a Meta spokesperson told The Register. "Upon becoming aware of the concerns, we decided to pause the feature while we work with Google to resolve the issue."
In other words, "whoops, we got caught out trying to violate the spirit if not the letter of Google's policies".
Can there have been any thought-process behind this mechanism other than "how can we continue to ID users within Google's constraints"?
Hands up anyone who will believe Meta next time they claim to take users' privacy seriously.
Meta Malware
And duckduckgo which blocks Meta Malware is not supported by many apps. Such as X. Go figure. US companies just dislike anything that stops them spying on you. Why all these apps are not categorized as malware is a big question.
Charge Meta 29 billion and give everyone in the EU a €100 voucher.
Scum
It's so scummy it's incredible. Sort of underhand behaviour you'd expect of authoritarian governments not a social media company! There should be laws (maybe there are) about data collection and notifying users, breaking them should incur serious personal fines of the company board members and major shareholders. That would stop it.
I don't install fb or Instgram etc and this sort of thing is why. But can they track via browsers? I only use fb because some people and organisations lack the imagination to communicate via other methods. I wish someone would sneak spyware onto the likes of Zuckerberg's devices and start publishing everything, that would be reasonable given his behaviour.
Re: Difference between authoritarian governments not a social media companies
"Sort of underhand behaviour you'd expect of authoritarian governments not a social media company!"
Test Question (100 points):
Name 1 (One) ethical principle where social media companies live by better standards than authoritarian governments.
Give examples (name, decade)
It's commonly used by [lame] software developers
Who can't code IPC/RPC without HTTP because they know no better. Time to enable firewall rules for localhost as well...
So they got caught. What gets me is why anyone would want to do this to another person they're not at war with is beyond me. Why do developers go along with it. Why don't they grow a pair and just say "no, it's wrong". I know marketing types will be behind this, they'll all sell their first born for glue if means a move up the greasy pole or a commission. Pisses me off!
Some do. But there are always others waiting to take their place, often those on H1-B visas who aren't generally in a position to rock the boat.
"a website integrating the Meta Pixel"
These pixel things are more than a decade old. Why is it that browsers don't simply ignore them ?
It's not like nobody knows what they're for, and a single pixel, in today's 4K environment, can't have the excuse of display or decoration.
Block them by default.
I'd suggest hanging the CEO who is responsible, but I know that will never happen.
See icon
''' We are in discussions with Google to address a potential miscommunication regarding the application of their policies. Upon becoming aware of the concerns, we decided to pause the feature while we work with Google to resolve the issue.'''
Burn them.
Burn them all with fire.
Then burn the ashes.
Meta
Just amazing how fast they cut the crap out when this was published on Arstechnica this morning.
I block over 1K IP addresses for farcefuckbook and yet they have whys of getting around the means that people use to stop their shit.
This cat and mouse stuff needs to end. User's should have a positive means of blocking any and all access from any web service if they so desire.
I know it will never happen, but, one can dream!