Sunday, October 18, 2026

Facebook Admits Tracking non-FB-users Data using its Tools – 61 % of Tested Apps Automatically Transfer Data To FB

New Investigation conducted based on the data tracking, brokerage reveal that Facebook tracking non-users and logged-out users outside its platform through its Business Tools.   

Researchers tested many numbers of apps and confirm that 61% of tested apps are frequently sharing the data into Facebook from the moment once user open the apps.

Privacy International analyzed the many of the Android Apps using some of the open source tools “mitmproxy“, an interactive HTTPS proxy in order to sniff the traffic to findout the apps activities.

Apps Developers are using Facebook Software Development Kit (SDK) to share the data to Facebook.

Apart from this, Apps are frequently sending data into Facebook sometimes it contains users sensitive data regardless of either user’s opt-outed from Facebook or users who do not have a Facebook account.

” Previous research has shown how 42.55 percent of free apps on the Google Play store could share data with Facebook, making Facebook the second most prevalent third-party tracker after Google’s parent company Alphabet. In this report, Privacy International illustrates what this data sharing looks like in practice, particularly for people who do not have a Facebook account.”

Privacy International Findings – Facebook Tracking

According To Privacy international findings here the some of key facts that performing by Facebook to collect the users Data.

  • 61 % of Tested Apps are automatically sending data FB including non-FB users and logged-out users.
  • In order to links advertiser with user behavior from different apps , apps that automatically transmit data to Facebook with a unique identifier, Google AAID & Apple’s IDFA.
  • It collects people’s activities, interests, behaviors and routines, some of which can reveal special category data, including information about people’s health or religion
  • Initially events data that communicates to Facebook using Facebook SDK which is initialized by transmitting data such as “App installed” and “SDK Initialized” to report each and every time when users open the specific apps.
  • Example tested apps are “Qibla Connect” (a Muslim prayer app), “Period Tracker Clue” (a period tracker), “Indeed” (a job search app), “My Talking Tom” (a children’s’ app),
  • Major 3 events “App installed”, “SDK Initialized” and “Deactivate app” alone shared the hundreds of millions of peoples users behavior.
  • Some of the data that sharing into Facebook are aggressively sensitive and its very detailed.
  • Main Example travel search and price comparison app “KAYAK”, which sends detailed information about people’s flight searches to Facebook, including: departure city, departure airport, departure date, arrival city, arrival airport, arrival date, number of tickets. 
  • Facebook’s Cookies Policy describes two ways in which people who do not have a Facebook account can control Facebook’s use of cookies to show them ads. Privacy International has tested both opt-outs and found that they had no discernible impact on the data sharing that we have described in this report.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Top 10 Best Ways To Secure Your Computer from Cyber Attacks

Most Difficult Security Challenges for CxO (Chief x Officers) During the Cyber Attack

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Hot this week

How To Access Dark Web Anonymously and know its Secretive and Mysterious Activities

What is Deep Web The deep web, invisible web, or...

How to Build and Run a Security Operations Center (SOC Guide) – 2023

Today’s Cyber security operations center (CSOC) should have everything...

Russian Hackers Bypass EDR to Deliver a Weaponized TeamViewer Component

TeamViewer's popularity and remote access capabilities make it an...

Web Server Penetration Testing Checklist – 2026

Web server pentesting is performed under three significant categories: identity,...

ATM Penetration Testing – Advanced Testing Methods to Find The Vulnerabilities

ATM Penetration testing, Hackers have found different approaches to...

Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups

Attackers abused compromised ConnectWise Cloud Backup credentials to access...

Anthropic’s Claude AI Uncovers Origins of NSA-Provided Cryptographic Keys After 25 Years

Anthropic says an internal Claude research model reconstructed how...

OpenBSD Kernel Flaw Dating Back 37 Years Enables Local Privilege Escalation to Root

A newly disclosed OpenBSD kernel exploitation chain combines a...

GhostAction Hackers Hide Credential-Stealing Malware in Fake Font Files Across 94 GitHub Repositories

GhostAction attackers have expanded their GitHub credential theft campaign...

SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data

Indian authorities have warned that SideCopy hackers are targeting...

New GhostBat Android Malware Targets 60 Banking and UPI Apps to Steal PINs

A new GhostBat RAT variant targets 60 Android financial...

New ROMULUS Malware Platform Uses Six Servers to Deliver Multiple Malicious Payloads

ROMULUS, a shared ClickFix delivery platform operating across six...

Related Articles

Recent News