Meta and search engine company Yandex have been “covertly tracking” Android users in the background of their devices, according to experts.
Academics at the Radboud University in the Netherlands and IMDEA Networks said they discovered Meta and Yandex have been tracking Android users’ browser activity without their consent and then using the data in their apps.
Meta said it was looking into the issue, while Yandex denied collecting any sensitive data.
Gunes Acar, assistant professor at Radboud University, said the “covert” data collection was spotted in January.
He said he discovered Meta’s apps, including Facebook and Instagram, and Yandex’s apps, such as Yandex Maps, were sitting in the background of Android devices and loading a script that sent data locally back to apps on users’ phones.
The scripts bypassed Android’s security measures and meant that Meta and Yandex could track what users were doing on web browsers, without the user consenting or even knowing, according to the expert.
“They are bridging these two worlds that we think are separate; web browsing and mobile app activities,” Dr Acar told Sky News.
“That’s very shocking.”
The apps were able to track users’ browser data on all major Android browsers, even if the user was in incognito mode, the academics said.
“It’s really concerning because it negates every privacy control that you have in modern browsers and also in modern mobile platforms like Android,” said Narseo Vallina-Rodriguez, associate professor at IMDEA Networks, to Sky News.
Google, which owns the Android operating system, confirmed the covert activity to Sky News.
It said Meta and Yandex used Android’s capabilities “in unintended ways that blatantly violate our security and privacy principles”.
What have Meta and Yandex said?
Meta told Sky News it was quickly looking into the issue.
“We are in discussions with Google to address a potential miscommunication regarding the application of their policies,” said a Meta spokesperson.
“Upon becoming aware of the concerns, we decided to pause the feature while we work with Google to resolve the issue.”
Yandex said it “strictly complies with data protection standards”, adding: “The feature in question does not collect any sensitive information and is solely intended to improve personalisation within our apps.”
Read more science and tech news:
AI foot scanner recognises heart warning signs
Coffee ‘helps women age more healthily’
Meta appeared to have been doing the data tracking for around eight months, while Yandex had since 2017, the academics said.
“We found that Facebook was doing it on roughly 16,000 websites when visited from the EU, […] Yandex was doing this on 1,300 websites,” said Tim Vlummens, a PHD student at KU Leuven who worked on the research.
Google told Sky News it had already “implemented changes to mitigate these invasive techniques and have opened our own investigation and are directly in touch with the parties”.
The tech giant did not respond when asked what repercussions Meta and Yandex were facing for their conduct.
Firefox, Microsoft Edge and DuckDuckGo browsers were also affected, with Firefox owner Mozilla and DuckDuckGo engineers taking action to stop any future covert tracking.
