2

Facebook has recently launched "off facebook activity" which lets you see all the activities shared by other apps/websites that you have interacted with.

But how did those apps and websites share that data with facebook, even when I didn't use facebook to log into them? In some cases, I have just surfed a website as an anonymous user, without signing up. Yet they were able to share activity data with Facebook.

Also please note the activities are NOT shared anonymously, but to my specific Facebook account. How did the website get access to my FB account id even when I didnt use FB to login?

622 Apps have shared data to FB

enter image description here

Although I used FB to login only into 5 apps.

enter image description here

You can access off facebook activities here https://www.facebook.com/off_facebook_activity/

Update 1:

I am concerned about other websites and apps tracking my activity. At least Facebook informed me.

For example:

+---------------------------------------------+----------+---------------------------------------------------+
|                   Portal                    | Platform |                       Auth                        |
+---------------------------------------------+----------+---------------------------------------------------+
| Godzilla (a fake popular app like facebook) | Chrome   | Signed up and logged in                           |
| Godzilla on phone                           | Android  | Godzilla on chrome (logged in). No app installed. |
| XYZ.com                                     | Chrome   | Anonymous user                                    |
| XYZ's app                                   | Android  | Anonymous app user                                |
+---------------------------------------------+----------+---------------------------------------------------+

In which of these above cases can XYZ track me?

Update 2:

FB received several activity events from these 2 android apps

  • Turbo VPN
  • Spotify

Even though I dont have facebook app on my phone. How can I prevent this?

jerrymouse
  • 121
  • 3
  • Welcome to Facebook's core business of collecting your data with your "consent". –  Apr 24 '20 at 13:17
  • @MechMK1 That is worrisome. But at least I am aware that Facebook has my data. There maybe 100s of other apps like Facebook that are tracking me "without my knowledge". I am interested to know how does can they track me and how to stop them. – jerrymouse Apr 24 '20 at 13:58
  • You can also install extensions in your browser to block these trackers. There are many discussions on which are good/best etc. (Google something like '[browser] tracker blocker'). These can also give you insight in the trackers a site has implemented. – roy.stultiens Apr 24 '20 at 14:14
  • Supposedly, if you have your phone number associated with Facebook, and you buy something from another company or register on a site using the same phone number, that data can also be shared with Facebook through their "Business Tools". – multithr3at3d Apr 24 '20 at 14:24

1 Answers1

2

This would be the work of Cookies, fingerprints and/or other tracking techniques. Many sites have a Facebook (tracking) pixel for advertising purposes, or inject Facebook scripts for including feeds or a like button. This sends data to FB about your visit and possibly any interaction you have with the website.

You do not need to login to these sites using FB, the cookies are enough for Facebook to know it is your account.

Useful links:

Also have a look at the answers given in this thread: How does Facebook track your browsing without third party cookies?

roy.stultiens
  • 138
  • 8
  • Can you also tell how does it work on Android? If I am using an XYZ android app anonymously and dont have facebook app installed, how can the XYZ app send events data to my facebook account? XYZ app does not contain any Like or share buttons. – jerrymouse Apr 24 '20 at 14:04
  • It depends on the app(s) you are using. Apps can implement FB tracking as well: https://developers.facebook.com/docs/app-ads/measuring/installs-and-in-app-conversions/ Other option is that the app is a 'web app' which opens a webpage. Then the same methods apply as for normal websites. – roy.stultiens Apr 24 '20 at 14:12
  • My FB account received several activity events from android apps, even though FB app is not installed on my phone. I have logged in using phone's chrome browser, which is now logged out and cookies cleared. Is this sufficient or is there any other way that these apps can still send data? – jerrymouse Apr 24 '20 at 15:49
  • @jerrymouse maybe the apps have access to your phone's number, and are using FB "Business Tools" to report back – multithr3at3d Apr 24 '20 at 16:22
  • I am using some apps on my phone without any sort of login. Like the VPNs. At most they have access to my IP. Not my phone number. At android level, they only have permission to use the internet, not my phone state. – jerrymouse Apr 24 '20 at 17:58
  • You should take a look at the privacy policy and data collection policy of those apps. If they share data with FB it _should_ be stated there. Otherwhise your IP and device fingerprint could also be used. Can you see which activity data FB received? Perhaps that gives insight into how FB got the data. – roy.stultiens Apr 24 '20 at 19:09