September 27, 2022

Meta is facing a proposed class-action lawsuit alleging it developed a secret workaround for Apple’s iOS privacy rules, allowing it to collect personal data without consent.

Last year, Apple changed the rules for iOS app developers, forcing them to seek user permission before their apps are allowed to collect tracking data. The Facebook app on iOS therefore has to ask permission from each user, but as Bloomberg reports(Opens in a new window)this lawsuit (Willis v. Meta Platforms Inc., 22-cv-05376) accuses Meta of circumventing the rules and tracking users regardless of their choices.

So how does this tracking work? The lawsuit explains how Meta’s Facebook app opens links in an in-app browser rather than the user’s default browser. That way, user activity can be easily tracked while bypassing Apple’s app privacy policies.

If this is indeed the case, it would technically violate Apple’s opt-out policy, but it would have to be proven in court. The lawsuit also alleges that this behavior violates state and federal laws that limit the unauthorized collection of personal information. Meta has not yet publicly commented on this issue.

Recommended by our editors

Back in August, researcher Felix Krause discovered that multiple apps were using in-app browsers to inject JavaScript into web pages to enable user tracking. Both the Facebook and Instagram apps have been proven to inject JavaScript, and Meta, in a comment that forms part of the JavaScript code it uses, states that it was “developed to respect people’s privacy and [App Tracking Transparency] election.”

PCMag Logo Practical with the Apple iPhone 14 line

Like what you read?

Sign up for SecurityWatch newsletter for our top privacy and security stories delivered straight to your inbox.

This newsletter may contain advertising, offers or affiliate links. Subscription to the newsletter means that you agree with ours Terms of use and Privacy Policy. You can unsubscribe from the newsletter at any time.

Source link

Leave a Reply

Your email address will not be published.