Instagram Can Track Users' Web Activity

A new analysis of the Instagram app by Felix Krause has revealed that all user actions, including text selections and text input, within the in-app browser are able to be tracked.

Unlike most apps that use Apple's Safari browser, Felix Krause pointed out in his analysis that Instagram and Facebook on iOS use their own built-in browser to load websites into the app.

According to Krause, Instagram and Facebook inject JavaScript tracking code called "Meta Pixel" into all displayed links and websites, allowing Meta to track users' interactions without their consent:

The Instagram app injects their tracking code into every website shown, including when clicking on ads, enabling them to monitor all user interactions, like every button & link tapped, text selections, screenshots, as well as any form inputs, like passwords, addresses, and credit card numbers.

Meta claims that "Meta Pixel" is designed to "track visitor activity on your website" by monitoring user actions. However, it's worth noting that there's no evidence that Meta actively collected user data.

Krause says that this practice contradicts Apple's App Tracking Transparency (ATT) policy, which requires users to consent to track actions on apps and websites.