Recent research has illuminated the data tracking practices of major technology companies, notably Meta Platforms and Yandex, regarding users on Android devices.

The findings indicate that browsing in incognito or private modes on these devices may not provide the expected levels of anonymity.

The study, conducted by an international team from Radboud University and IMDEA Networks, reveals that Meta employs a newly discovered tracking method via applications it owns, including Facebook and Instagram.

This method operates even when users are not logged into these platforms and while utilizing private browsing features or after deleting cookies and other browsing data.

Researchers found that the tracking techniques could be applied to websites that lack explicit and compliant cookie consent practices, meaning tracking scripts may load prior to user consent.

A specific script known as Meta Pixel is embedded within millions of websites, facilitating communication between these sites and applications installed on mobile devices.

This connection allows the aggregation of browsing sessions and web cookies with device identifiers, enabling the linking of collected data back to users' Facebook or Instagram accounts.

The primary goal of this tracking is to provide advertisers with metrics regarding the effectiveness of their advertising campaigns, a practice that Meta has been engaged in since at least September 2024. Similarly, Yandex, a major Russian search engine, has utilized a comparable tactic with its applications and the Yandex Metrica script since 2017. However, following June 3, 2025, the Meta Pixel script reportedly ceased functioning, with nearly all of its underlying code being removed from the corresponding web pages.

Estimates indicate that the Meta Pixel and Yandex Metrica scripts are present on approximately 5.8 million and 3 million websites, respectively, with a notable focus on Android users, who may be subject to exploitation of legitimate internet protocols and the inherent communication capabilities of Android with third-party applications.

Although the monitoring strategy has yet to be observed on iOS platforms, the researchers note that similar data sharing between iOS browsers and native applications is technically feasible.

The study indicates that the issue specifically affects Chrome and Chrome-based browsers, suggesting that migration to security-oriented browsers like DuckDuckGo or Brave might help users avoid undesirable tracking practices.

Although the removal of the Meta script enhances user security, it was noted that users with installed Yandex applications on their mobile devices could still be monitored.

Uninstalling Facebook and Instagram applications is also suggested as a remedy.

Google has acknowledged the tracking issue and is thought to be considering improvements to the way Android manages access to local ports and data exchange between web browsers and native applications, though it remains uncertain if any definitive action will be taken.