Meta and Russian search engine Yandex have been secretly tracking what Android users do on their web browsers—even when users are in private or incognito mode—according to experts from Radboud University and IMDEA Networks.

Researchers discovered that Meta’s apps like Facebook and Instagram, and Yandex’s apps such as Yandex Maps, were running hidden scripts in the background on Android phones. These scripts sent browser activity data back to the apps without users knowing or giving consent.

This bypasses Android’s security rules and breaks privacy protections built into browsers and the Android system itself.

Google confirmed these companies used Android features "in unintended ways that blatantly violate our security and privacy principles."

Meta said it’s investigating the issue and paused the tracking feature while working with Google. Yandex denied collecting sensitive data and said the feature only improves personalization in their apps.

The covert tracking by Meta reportedly lasted about eight months and involved data from 16,000 websites in the EU. Yandex has been doing this since 2017, with data from 1,300 sites.

Major browsers like Firefox, Microsoft Edge, and DuckDuckGo were affected, but Mozilla and DuckDuckGo have taken steps to block this kind of tracking.

Copied