“LOCALHOST TRACKING” EXPLAINED. IT COULD COST META 32 BILLION

Summary from the TLDR InfoSec newsletter

Meta deployed “localhost tracking” that bypassed Android security protections by using its mobile apps to listen on local network ports while tracking scripts in web browsers sent user identifiers via WebRTC, linking anonymous browsing activity to real Facebook/Instagram identities even when users employed VPNs, incognito mode, and deleted cookies. The scheme affected 22% of the world's most visited websites and collected complete browsing histories, purchases, and behavioral patterns without proper consent across billions of users over multiple years. Meta now faces potential fines of €32 billion under GDPR, DSA, and DMA regulations for violating data protection, personalized advertising restrictions, and rules governing the combination of cross-platform data.