You’ve probably noticed that a special in-app browser is utilized when you visit a website that displays on Facebook and Instagram rather than your usual web browser. These browsers seem to add javascript code to every page you visit, possibly allowing parent Meta to track you as you switch between sites.

To monitor all user interactions, such as every button and link clicked, text choices, screenshots, and any form inputs, such as passwords, addresses, and credit card numbers, the Instagram app injects its tracking code into every website shown, including when clicking on advertisements, claims researcher Felix Krause. His research focused on iOS versions of Facebook and Instagram. This is important since Apple introduced App Monitoring Transparency (ATT) with iOS 14.5 and allows users to decide whether or not to enable app tracks when they first open an app.

The code enables us to aggregate user data before utilizing it for measurement or targeted advertising, a Meta spokesman told The Guardian. We don’t add any pixels. We can collect conversion events from pixels by injecting code. Krause argued that Facebook might not always be using javascript injection to get sensitive data. If the apps launched in the user’s preferred browser, such as Safari or Firefox, it would be difficult to carry out a comparable javascript injection on any safe website. In contrast, he claimed that the approach used by Instagram and Facebook’s in-app browsers “works for any website, regardless of whether it is encrypted or not.”