Meta halts Android tracking method using localhost ports following privacy concerns

Security researchers from institutions in Spain, the Netherlands, and Belgium have revealed that Meta and Yandex exploited localhost communication on Android devices to bypass privacy protections and link user identities to web browsing data. The technique involved native apps such as Facebook, Instagram, and Yandex Maps listening on specific TCP and UDP ports. JavaScript tracking scripts embedded on websites (Meta Pixel and Yandex Metrica) used this loophole to transfer cookies and metadata from mobile browsers to the native apps running on the same device.

This setup allowed the companies to connect browser activity with user accounts by transferring identifiers like the _fbp cookie and other personal metadata via WebRTC and related protocols. The data was then sent to Meta’s backend via GraphQL APIs. Researchers noted this behavior began in September 2024 and seemed to stop after public disclosure. As of early June 2025, Meta’s tracking scripts no longer send data to localhost, and much of the tracking code has been removed.

Google and browser vendors have started implementing technical countermeasures. Chrome introduced limited protections in version 137, Brave is unaffected, and DuckDuckGo and Firefox are working on mitigations. The controversy raises concerns about user privacy and the need for stricter permissions on local network access.