Meta Instagram has been exposed to track users' network activities through browsers in App, which has violated Apple's iOS privacy policy.
CTOnews.com, August 14 (Xinhua)-- A new analysis of Meta's Instagram app shows that Instagram can monitor all interactions, text selections, and even text input every time a user clicks on a link within the app, such as an intranet password and private credit card details app.
Felix Krause analysis found that the iOS version of Instagram and Facebook both use their own in-app browsers rather than the Safari browsers provided by Apple for third-party apps.
Using their customized browser (still based on WebKit), Instagram and Facebook inject tracking JavaScript code into all display links and websites. Krause found that with this code, Meta is completely free to track user interactions without the explicit consent of the user.
This allows Instagram to monitor what is happening on external sites without the consent of the user or the website provider.
The Instagram application injects tracking code into each site displayed, including when clicking an advertisement, enabling them to monitor all user interactions, such as clicking each button and link, text selection, screenshots, and any form input, such as passwords, addresses, and credit card numbers.
As Krause points out, it takes a bit of development effort for companies like Meta to develop and maintain their own in-app browsers without using Apple's built-in Safari. On its developer portal, Meta said the move was aimed at "tracking visitor activity" on the site by monitoring all events done by users in their custom browsers.
However, there is no evidence that Meta, which owns Instagram, is actively collecting user data. As Krause wrote:
Facebook doesn't actually steal users' passwords, addresses, and credit card numbers. I don't have proof yet. I just want to show the types of data they can get without their knowledge. As has been shown in the past, if companies can access data for free without asking for permission, they will choose to track it.
But this violates Apple's App Tracking Transparency (ATT) policy. ATT requires all applications to seek user consent before tracking them across applications and websites owned by other companies.
Meta has repeatedly objected to Apple allowing users to choose which targets they want to be tracked. In December 2020, Meta ran a full-page newspaper ad attacking Apple's changes. Krause said he shared the findings with Meta, and Meta responded that they had identified the "problem" but had not responded since. Krause said Meta had been notified two weeks in advance of the decision to disclose his findings.
