Facebook and Instagram In-App Browser Tracking: Privacy Risks and How to Protect Yourself in 2026

Security researcher Felix Krause reveals that Facebook and Instagram use embedded browsers in their apps to track user activity on third-party sites, posing privacy risks. This article examines how these browsers work, the information they collect, and how Apple’s ATT helps to protect iOS users' data.

Ozan Ucar, Founder and CEO of Keepnet

Last Updated: 2026-06-01

Security Risks of Embedded Browsers in Facebook and Instagram

Facebook and Instagram applications use embedded browsers that automatically open when you click on external links within the app, rather than opening your default browser. This behavior allows Meta to inject JavaScript code into visited websites, enabling tracking of user interactions including form inputs, button clicks, and purchases made on external sites. The practice was first documented in detail by security researcher Felix Krause in August 2022. By 2026, this tracking approach has attracted regulatory scrutiny under the EU Digital Markets Act (DMA), GDPR enforcement actions, and US state privacy laws. Meta was fined over 1.2 billion euros by Ireland's Data Protection Commission in 2023 in a related data transfer case, and regulators continue to examine the in-app browser's data collection practices.

Why Embedded Browsers are Used

Typically, when you click on a link within an app, it opens in a default web browser. However, Facebook and Instagram create a built in browsing experience by embedding an internal browser to display these sites. While this approach offers a seamless in app experience, it also allows the apps to run custom JavaScript code on any third party websites you visit through these browsers. This technique lets the host app observe user interactions such as clicks, scrolls, and even sensitive input like credit card information.

What Information Facebook and Instagram Can Track

When using the in app browser, Facebook and Instagram gain the ability to monitor a wide range of user interactions, including:

Passwords entered on login pages,
Home addresses or other sensitive details filled out in forms,
Credit card information during online purchases,
On screen selections or menus clicked, and
Text inputs in any form fields.

This capability allows Facebook and Instagram to collect extensive user data, tracking your digital footprint across different websites without requiring your explicit consent.

The Role of JavaScript in Data Collection

Facebook and Instagram achieve this data collection by injecting JavaScript code into the web pages loaded through their embedded browsers. This script can track user interactions on these external sites. Any data entered on a page viewed in the in app browser can potentially be captured and sent back to Facebook or Instagram, allowing them to collect data about your browsing habits and behavior.

For example, if you click on an ad within Instagram and complete a purchase on the advertiser’s website, Facebook may collect information about that transaction directly through the embedded browser.

Apple’s Response: App Tracking Transparency (ATT)

To protect user privacy, Apple released the App Tracking Transparency (ATT) framework in iOS 14.5, requiring apps to request user permission before tracking activity across other companies' apps and websites. Meta reported a significant impact on its advertising revenue following ATT's rollout, estimating a $10 billion annual revenue reduction. However, ATT does not prevent in-app browser JavaScript injection, which operates within the app's own context. In 2025, Apple introduced additional privacy protections in iOS 18 that further restrict cross-app tracking, but the in-app browser data collection mechanism remains a separate privacy concern that ATT alone does not address.

How ATT Works to Block Data Collection

ATT requires that apps:

Request permission from users before tracking them across third party websites.
Offer transparency about the types of data they wish to collect and for what purpose.

If a user declines tracking, iOS restricts the app’s ability to gather data about their activity on other sites, providing users with more control over their privacy.

Despite ATT, however, Facebook and Instagram can still track user interactions within their embedded browsers, as this monitoring occurs directly in the app rather than across external applications. Therefore, while ATT mitigates some privacy concerns, embedded browsers remain a loophole for in app data collection.

How to Protect Yourself from In App Browser Tracking

Given the potential privacy risks, here are some steps to safeguard your data when using apps like Facebook and Instagram:

Avoid clicking on external links within the app if possible.
Copy links and open them in a separate browser like Safari or Chrome.
Use iOS settings to manage permissions, opting out of app tracking requests when prompted.
Stay informed about how apps collect and use data by regularly reviewing app privacy policies

While ATT has provided a layer of protection against cross-app tracking, users must still take active steps to protect their data when using in-app browsers. In 2026, privacy-conscious users should open external links in dedicated privacy-focused browsers, disable Meta's in-app browser where app settings allow, limit the personal information entered in pages accessed through social media apps, and review Meta's privacy settings to restrict data collection. Organizations should include in-app browser privacy risks in employee mobile security training, particularly for staff who access sensitive business information from mobile devices.

Editor's Note: This article was updated on June 1, 2026.

Schedule your 30-minute demo now

You'll learn how to:

Discover tracking protection strategies that limit in-app browser data collection and increase user privacy.

Identify risky app behaviors with tools that analyze and report on embedded JavaScript use.

Implement app usage policies that educate users on managing privacy settings to minimize exposure to data collection.

Frequently Asked Questions

What is an in app browser and why do apps like Facebook and Instagram use them?

An in app browser is a built in web browser embedded within a mobile app that opens external links without leaving the app. Facebook and Instagram use in app browsers because they allow the platform to keep users within its own environment, maintain session continuity, inject tracking code into visited pages, and attribute conversions from ads to specific user actions. While this provides a smoother user experience for some purposes, it also enables the app to monitor activity on external websites in ways that a standard browser would not permit.

What data can Facebook and Instagram collect through their in app browsers?

When a user taps a link within Facebook or Instagram and it opens in the in app browser, the platform injects JavaScript code into the loaded webpage. This code can monitor all interactions on the page, including text typed into forms such as passwords and addresses, button taps, and scroll behavior. It can also observe purchases completed on external advertiser websites. The purpose is primarily advertising attribution and analytics, but the capability extends to any user interaction on any website opened through the in app browser.

How does JavaScript injection work in in app browsers?

JavaScript injection works by inserting a script tag into every webpage the in app browser loads. The injected script runs in the context of the visited page, giving it access to the page's DOM, including any input fields and their values. This is the same mechanism that legitimate analytics tools use when website owners add tracking pixels to their own pages, except in this case the script is being added by the app rather than the website owner. The website operator has no control over this process and may be unaware that additional scripts are running on their pages when accessed through certain apps.

What is Apple's App Tracking Transparency and does it stop in app browser tracking?

Apple's App Tracking Transparency (ATT) framework, introduced in iOS 14.5, requires apps to ask user permission before tracking their activity across other companies' apps and websites. If a user declines, iOS restricts the app's ability to access the device's advertising identifier and limits some cross app tracking. However, ATT does not prevent an app from injecting JavaScript into web pages opened within its own in app browser. The in app browser operates within the app's own context, which is outside the scope of what ATT was designed to block.

How can users protect their privacy when using Facebook or Instagram?

Users who want to avoid in app browser tracking should copy external links and paste them into a standard browser such as Safari or Firefox rather than tapping them directly within the app. They should avoid entering sensitive information such as passwords, payment details, or personal addresses in pages accessed through social media apps. Enabling the ATT opt out for Facebook and Instagram reduces some forms of cross app tracking. Using a browser with tracking protection enabled when visiting financial or health related websites adds an additional layer of privacy.

Is the data collection by Facebook and Instagram in app browsers legal?

The legality of in app browser data collection depends on the jurisdiction and how the data is used. In regions covered by GDPR, organizations must have a lawful basis for processing personal data and must provide transparent disclosures. Meta discloses its data collection practices in its privacy policy, which users consent to when they accept the platform's terms. Regulatory bodies in several countries have investigated Meta's data practices, resulting in significant fines. Users and organizations operating in regulated industries should be aware that sensitive data entered through in app browsers may be collected by the platform.

What are the implications of in app browser tracking for organizations?

For organizations, the primary concern is that employees may inadvertently expose corporate credentials or sensitive business information by accessing work related pages through social media in app browsers. If an employee taps a link in a Facebook or Instagram message and accesses a corporate login page, internal document, or sensitive external resource through the in app browser, that activity and any data entered may be observable by the platform. Organizations should include guidance on this risk in their security awareness training and mobile device policies.

Does the same in app browser tracking risk apply to other apps beyond Facebook and Instagram?

Yes. Many apps that include social or communication features also use in app browsers to open external links, and some inject their own JavaScript for analytics or monetization purposes. The research that exposed Facebook and Instagram's practices highlighted a broader issue with how apps handle external web content. TikTok, Snapchat, and other platforms with large user bases have also been examined for similar practices. The safest approach is to avoid entering sensitive information in any page opened through an in app browser from a social media or messaging platform.

How should organizations train employees about in app browser privacy risks?

Security awareness training on this topic should explain what in app browsers are and how they differ from standard browsers, demonstrate what data can be collected when employees access corporate resources through social media apps, provide clear guidance on when to use standard browsers instead, and cover safe mobile usage policies. Including this scenario in regular security awareness training helps employees make informed decisions about where and how they access sensitive information on mobile devices.

What is the broader significance of in app browser tracking for digital privacy in 2026?

In app browser tracking represents a broader tension between the convenience of integrated app experiences and the privacy expectations of users. As regulators in the EU, US, and elsewhere scrutinize platform data practices more closely, the rules governing in app tracking are likely to evolve. For 2026, organizations and individuals should operate on the assumption that any link opened within a social media or advertising supported app may be subject to additional tracking, and adjust their information sharing behavior accordingly. The safest default is to open sensitive links in a dedicated, privacy respecting browser.