Meta pauses mobile port tracking tech on Android after researchers cry foul

Security researchers say Meta and Yandex used native Android apps to listen on localhost ports, allowing them to link web browsing data to user identities and bypass typical privacy protections. Following the disclosure, researchers observed that Meta's Pixel script stopped sending data to localhost and that the tracking code was largely removed. The move may help Meta avoid scrutiny under Google Play policies, which prohibit covert data collection in apps. "We are in discussions with Google to address a potential miscommunication regarding the application of their policies," a Meta spokesperson told The Register. "Upon becoming aware of the concerns, we decided to pause the feature while we work with Google to resolve the issue." Meta's spokesperson did not respond to a request to elaborate on the company's discussions with Google. In a report published Tuesday, computer scientists affiliated with IMDEA Networks (Spain), Radboud University (The Netherlands), and KU Leuven (Belgium) describe how the US social media giant and the Russian search engine were observed using native Android apps to gather web cookie data via the device's loopback interface, commonly known as localhost. Localhost is a loopback address that a device can use to make a network request to itself. It's commonly used by software developers to test server-based applications like websites on local hardware. The researchers – Aniketh Girish (PhD student), Gunes Acar (Assistant Professor), Narseo Vallina-Rodr...