Meta Sued For Skirting Apple Privacy Rules To Snoop On Users

An anonymous reader quotes a report from Bloomberg: Meta was sued for allegedly building a secret work-around to safeguards that Apple launched last year to protect iPhone users from having their internet activity tracked. In a proposed class-action complaint filed Wednesday in San Francisco federal court, two Facebook users accused the company of skirting Apple's 2021 privacy rules and violating state and federal laws limiting the unauthorized collection of personal data. A similar complaint was filed in the same court last week. The suits are based on a report by data privacy researcher Felix Krause, who said that Meta's Facebook and Instagram apps for Apple's iOS inject JavaScript code onto websites visited by users. Krause said the code allowed the apps to track "anything you do on any website," including typing passwords.

According to the suits, Meta's collection of user data from the Facebook app helps it circumvent rules instituted by Apple in 2021 requiring all third-party apps to obtain consent from users before tracking their activities, online or off. Meta has said it expected to miss out on $10 billion in ad revenue in 2022 because of Apple's changes. The Facebook app gets around Apple privacy rules by opening web links in an in-app browser, rather than the user's default browser, according to Wednesday's complaint. "This allows Meta to intercept, monitor and record its users' interactions and communications with third parties, providing data to Meta that it aggregates, analyzes, and uses to boost its advertising revenue," according to the suit. A Meta spokesperson said the allegations are "without merit" and the company will defend itself. "We have designed our in-app browser to respect users' privacy choices, including how data may be used for ads," the company said in an emailed statement.

Facebook is in the data mining business

[Bryan Gritton]

There has never been anything accidental about any of the privacy scandals Facebook has had during its history. It exists to mine as much data about you as they can. Sometimes they get caught doing it illegally, and they apologize for getting caught. But it's never accidental, and they are never sorry.

Re:Facebook is in the data mining business

[splutty]

We're sorry we were caught. Our apologies. We'll try harder to hide what we're doing next time. Promise!

Re:

[l0ungeb0y]

Why should Meta suffer consequences just because someone noticed their bad behavior?

Re:

[VeryFluffyBunny]

They're all in the data-mining business (otherwise known as "surveillance capitalism"). Smartphones are designed from the ground up to serve surveillance corporations. The afterthought of user privacy is a PR & marketing term to try to obfuscate the true nature of the business. The only solution to this problem is laws with strongly deterrent enforcement; a bill of online rights, if you will.

Re:

[Narcocide]

Not to defend Meta here, because you're probably right, but there is always the possibility that the advertisers have found a way around the blocks themselves, like they have here on Slashdot recently with these stupid ad slide-outs in the bottom right corner of the page when you scroll down too far.

Re:

[splutty]

Disable Javascript. Slashdot works fine in classic mode without Javascript.

Meta Privacy Best Privacy.

[splutty]

All those other websites can't keep up with Meta Privacy (TM), so we at Meta decided that Meta Privacy (TM) should be applied to all other websites, so you can enjoy Meta Privacy (TM) without having to think of your own privacy rules!

Choices

[Joce640k]

"We have designed our in-app browser to respect users' privacy choices, including how data may be used for ads,"

I'm guessing that most users have never even seen those "choices" and that everything is enabled by default.

I love it that Fecesbook is being sued but...

[jenningsthecat]

We're long, long past the point where personal responsibility should have kicked in. Anyone who is just browsing the web and being tracked by FB pixels has a legitimate beef. But those who are knowingly using the scandal-ridden service have only themselves to blame for Meta tracking them and invading their privacy.

If you insist on sleeping with the Devil, you're gonna get burned regardless of whatever promises he makes, and you're probably gonna get fucked up the ass too. So stop sleeping with the Devil!

Re:

[sinij]

You could make similar arguments about smoking, yet the society decided to both limit the activity and to put effort into educating and warning the addicts.

Re: I love it that Fecesbook is being sued but...

[PPH]

stop sleeping with the Devil!

She keeps crawling into bed with me after I doze off. And she has cold feet.

Re:

[gweihir]

You are arguing for personal responsibility in _this_ human race?

Facebook is not credible

[sinij]

A FB spokesperson said the allegations are "without merit" and the company will defend itself. "We have designed our in-app browser to rape users' privacy, including leaking data to be used for ads," the company said in an emailed statement. "If users objected to the abuse, they would have resisted more. Regardless, the FBI is actively monitoring the situation." added the spokesperson.

Re: Ban Facebook and the google.

[Pinky's Brain]

Apple doesn't want to do social networking, it's brand poison.

How does meta insert javascript code in other apps

[mark-t]

I mean, unless they are talking about using some web browser functionality *within* their own app, I'm entirely unsure how something like this would be technologically possible, given the way that each app is sandboxed in iOS.

In ordinary circumstances, how does facebook track what people do in Safari, for instance?

Re:

[splutty]

That's exactly what they're talking about.

You use the Facebook app, the Facebook app has its own built-in web browser, which the Facebook app uses to open all links you use from within the Facebook app, so your Safari isn't ever being used, at any point.

This way the app can modify each and every page you view the way they want.

Re:

[mark-t]

So the workaround is for people to always open links in another app by clicking "share" and then accessing safari, yes?

Re:

[splutty]

That might work, no clue. It might still just redirect you through Facebook with a custom link, although at least you won't have the added javascript.

Re:

[Dru Nemeton]

I don't use the FB app, but the reddit app gives the user a settings choice to open links within the app, or to open links externally in a web browser.

And last I knew, regardless of the web browser used, Apple requires all of them to use WebKit for the browser. So regardless if you're using Chrome, FireFox, etc., they're all just a custom UI over WebKit.

So it would seem that part of this should fall on Apple's shoulders since it's their WebKit that's being hacked as an in-app browser.

Re:

[mark-t]

Even if they are using webkit, however, by virtue of being inside of the facebook app, the custom browser can exchange data with other components of the app.

Re:

[Joce640k]

I think they only redirect the links clicked inside the Facebook app.

Re: How does meta insert javascript code in other

[PPH]

Apps are poison. If I can't access something with Firefox, I'm not interested.

Re:

[mugnyte]

The root tracking mechanisms are multi-layer. Your clicks on a link are the simplest. Opening links within the app allow all traffic and keystrokes to pass thru FB's capture systems for later customer segmentation for advertisers. Plus:

• - If location data is turned on, one can buy advertising for users in a locale within a recent or upcoming timeframe
• - Urls are manipulated to either use parameters (as simple as something like "&f=123") which couples with large websites getting paid to include a serv

Re:

[mugnyte]

I should add: This user profile is recreated several times across the larger players, and governments, law enforcement, schools and parental oversight will be sold their own platforms.

Re:

[Todd Knarr]

tl;dr: "The Minority Report" was supposed to be a cautionary tale, not a requirements document.

Nope

[Shaitan]

"respect users' privacy choices" does not equal "obtain consent from users before tracking their activities, online or off"

All you have to do to create the divide is limit the specificity of the data being collected and limited the choices you make available to users. Even a default on data collection with an option to disable (opt-out) violates that requirement... and should.

Re:

[Locke2005]

Meta already has a consent decree with the FTC establishing a program to monitor ALL apps to protect privacy. This certainly looks like it violates that consent decree to me.

So was it authorised?

[Pinky's Brain]

The browser is part of the app, so was the data collection really unauthorised? Seems unlikely.

Really?!?

[Locke2005]

Meta already has a consent decree signed with the FTC in 2011 agreeing to respect consumers privacy. Does this action violate that consent decree? "Facebook 2011 consent decree required to establish and maintain a comprehensive privacy program designed to address privacy risks associated with the development and management of new and existing products and services, and to protect the privacy and confidentiality of consumers' information"

Facebook is a criminal enterprise

[Otis B. Dilroy III]

And the Zuck should be prosecuted under the RICO act.

Apple should ban their app

[AmazingRuss]

... if they aren't going to comply with the rules.

Choose your mobile OS

[Rosco P. Coltrane]

Be under surveillance by Facebook and Apple, or by Facebook and Google. Ah, the agony of choice...

Incidentally, it's FACEBOOK, not Meta. Meta is the name of the holding company Facebook created to hide its name and its earnings behind.

What did the users expect?

[MobyDisk]

Suing Meta because Facebook tracks you is like suing Marlboro because cigarettes give you cancer. It's an endemic feature of the product. If you care about lung cancer, stop smoking. If you care about privacy, stop installing Facebook.

I'm not forgiving Meta for what they are doing -- but I just don't understand the mindset of someone who uses Facebook and expects privacy.

How dare you build a gated garden in my walled gar

[Smonster]

This is dumb. Perhaps I am savvy that your average FB user, but it seems plain obvious that if you are using a browser embedded in an app than then they are probably harvesting that data. Google does the same thing with maps. However they make it even less seamless to switch to safari. instead of link in a tab to open in safari; you have to copy the link, manually switch to safari, and than paste the link in order to get the info out of google gated garden. If someone is too dumb to figure that out, is that