What was the 'localhost' tracking bug Meta got caught using?
Academic researchers disclosed on June 3, 2025 that Meta Pixel, embedded on roughly 5.8 million websites, sent tracking cookies through the device's own loopback interface to the Facebook and Instagram apps, silently linking web browsing to a user's logged-in identity — bypassing Incognito Mode, cookie-clearing, and Android's app sandbox. Meta halted it the same day Google shipped countermeasures.
Answered in
How Meta Actually Tracks You: Inside Facebook, Instagram and WhatsApp's Surveillance MachineA localhost backdoor beat Incognito Mode. Instagram DMs lost encryption entirely. Here's how Meta's tracking machine really works, fact by fact.
Read the full analysisOther questions this article answers
More ai & society questions
- Is model distillation always an attack?
- How much did Anthropic say its new controls reduced extraction?
- Does Anthropic's self-assessment block harmful requests?
- How accurate is Claude's self-assessment monitor?
- Are ChatGPT locked chats end-to-end encrypted?
- Do locked chats change model training or retention?
- What did the dissertation study measure?
- Does an AI-detector flag prove a student used AI improperly?
Every answer on Crashtech is written by the editor of the article it comes from — never auto-summarised. Browse all answers or the AI & Society beat.