Meta was sued on Wednesday for alleged undisclosed tracking and data collection in its Facebook and Instagram apps on Apple iPhones.
The
lawsuit [PDF], filed in a US federal district court in San Francisco, claims that the two applications incorporate use their own browser known as a
WKWebView that injects JavaScript code to gather data that would otherwise be unavailable if the apps opened links in the default standalone browser designated by iPhone users.
The claim is based on the findings of security researcher Felix Krause, who last month published
an analysis of how WKWebView browsers embedded within native applications
can be abused to track people and violate privacy expectations.
"When users click on a link within the Facebook app, Meta automatically directs them to the in-app browser it is monitoring instead of the smartphone’s default browser, without telling users that this is happening or they are being tracked," the complaint says.
"The user information Meta intercepts, monitors and records includes personally identifiable information, private health details, text entries, and other sensitive confidential facts."
Confronted last month with Krause's findings, Meta insisted its code injection was done to respect its users' privacy choices (apart from their choice of default browser).
"We intentionally developed this code to honor people's App Tracking Transparency (ATT) choices on our platforms," a Meta spokesperson told
The Register last month. "The code allows us to aggregate data before it is used for targeted advertising or measurement purposes."
www.theregister.com
