Researchers Reveal Meta and Yandex Secretly Tracked Android Users’ Browser Activity Without Consent

Researchers from Radboud University in the Netherlands and IMDEA Networks have uncovered that Meta and Yandex have been covertly tracking Android users’ browser activity without their consent. The tracking was discovered in January, when it was found that apps like Facebook, Instagram, and Yandex Maps were running background scripts on Android devices. These scripts bypassed Android security features and sent browser data back to the apps, even when users were in incognito mode. This activity affected all major Android browsers and compromised privacy controls designed to protect users. Google, which owns Android, confirmed that Meta and Yandex exploited Android capabilities in ways that violated its security and privacy principles. Meta claimed to be investigating the issue and has paused the feature, while Yandex denied collecting sensitive information and stated the feature was for app personalization. The research indicated Meta’s tracking had been ongoing for about eight months, while Yandex’s activity dated back to 2017. The scope was significant, with Facebook tracking on around 16,000 websites and Yandex on 1,300, particularly when accessed from the EU. Other browsers like Firefox, Microsoft Edge, and DuckDuckGo were also affected, prompting their developers to implement measures to prevent further covert tracking. Google has since implemented changes to block these invasive techniques and launched its own investigation, but has not disclosed any repercussions for Meta or Yandex.