Felix Krause summarizes the permissions Meta sees and has :
“The Instagram app injects tracking code into every website shown, including when clicking on ads, allowing them to track all user interactions like every button tapped and link, text selections, screenshots, addresses, credit cards and even any form input like passwords. “
Meta May Face Significant Sanctions
His research focuses on the iOS versions of Facebook and Instagram . This is important because Apple allows users to enable app monitoring or exit the app the first time they open an app via App Tracking Transparency (ATT) introduced in iOS 14.5.
Meta said the tracking code injected matches users’ preferences in ATT. “The code allows us to collect user data before using it for targeted advertising or measurement purposes ,” a spokesperson told The Guardian . said. Krause also said the approach used by Instagram and Facebook in-app browsers “works for any website, encrypted or not . “