The Hidden Danger of Facebook‘s Link History Tracking (And How to Disable It)

As a cyber security professional who has specialized in cloud data privacy for over a decade, I‘ve become increasingly alarmed by the pervasive and invasive tracking of individuals‘ online activity by tech giants – especially Facebook (Meta). One of the sneakiest tactics Facebook employs is "link history" tracking, whereby it collects data about your browsing activity across millions of third-party websites, not just on facebook.com. This allows Facebook to construct an incredibly detailed profile of your interests, relationships, behaviors, and vulnerabilities, which it monetizes through targeted advertising and data brokerage deals.

How Facebook‘s Link Tracking Works

Here‘s how it works under the hood: Facebook has partnerships with over 8.4 million websites (according to its own Marketing Partners website) to embed social media share/like buttons, conversion pixels, and invisible tracking scripts. Any time you visit one of these sites while logged into Facebook, it logs data on which pages you browse and connects it to your Facebook identity using browser cookies, pixel tags, and other uniquely identifying information like your IP address or device ID. This means Facebook can track you even if you never click a single share/like button outside of its own platform.

Facebook euphemistically refers to this expansive off-site data collection as "Activity That You‘ve Chosen to Share With Us" in its user settings. In reality, most people have no idea that Facebook is aggregating their browsing history in this manner, as it‘s enabled by default without explicit consent on each website. Per a 2018 analysis by Princeton researchers, Facebook tracking code is present on an estimated 25% of the top 1 million websites.

The Real Reason Facebook Wants Your Web History

Facebook claims that link tracking helps provide "better ad suggestions" and show you "what you‘ve recently looked at." However, the true purpose is to relentlessly harvest your personal data in order to power its lucrative advertising and data brokerage businesses. After all, Facebook generated a staggering $85 billion revenue in 2020, over 98% of which came from advertising. And according to a 2017 ProPublica report, Facebook even allows advertisers to target users based on interests like "incest," "white genocide conspiracy theory" and "jew hater" (which it later claimed to eliminate after public backlash).

By piecing together your web browsing patterns with everything else it knows about you (e.g. demographics, social connections, private messages, facial photos, location history, etc.), Facebook can infer extremely intimate details for marketing, manipulation, or monetization – often in ways users never expected. As former Facebook product manager Antonio García Martínez put it, "Facebook can learn almost anything about you by using artificial intelligence to analyze your behavior… Facebook knows more about you than the CIA ever will."

Facebook‘s Atrocious Privacy Track Record

Unfortunately, none of this is surprising given Facebook‘s long history of mishandling user data. Here are just a few of the many scandals that have plagued the company in recent years:

• Cambridge Analytica: In 2018, news broke that political consulting firm Cambridge Analytica had harvested data on up to 87 million Facebook users without consent for the purpose of voter profiling/targeting in the 2016 US presidential election. While Facebook CEO Mark Zuckerberg apologized in Congressional testimony, the company had already known about the improper data sharing since 2015 but failed to alert users. It later came out that Cambridge Analytica was just one of many companies Facebook gave privileged access to user data.

• Psychological experiments: In 2012, Facebook conducted psychological experiments on 700,000 unknowing users by selectively showing them more positive or negative content to see how it affected their emotions. Again, the company failed to get informed consent or notify those affected.

• Insecure data storage: In 2019, cybersecurity firm UpGuard discovered over 540 million Facebook user records left publicly exposed on Amazon cloud servers by third-party apps. The data included comments, likes, reactions, account names, and more. Separate investigations found Facebook had stored up to 600 million user passwords in plain text on its internal servers, with some dating back to 2012.

• Using 2FA numbers for ad targeting: After encouraging users to enable two-factor authentication using their phone numbers, Facebook was caught [allowing advertisers to target those same numbers] in violation of its own policies. It also collected users‘ call and text message logs when syncing contacts.

The list goes on and on, with Facebook accruing billions in fines from the FTC and other global regulators for its privacy missteps. The company is also facing multiple class action lawsuits for unlawful collection of biometric data. As early Facebook investor Roger McNamee argues in his book Zucked, Facebook‘s entire business model is predicated on "treating users as products whose data can be monetized without meaningful consent."

How to Turn Off Facebook‘s Link History Tracking

Fortunately, you can take a concrete step to curtail Facebook‘s data harvesting by turning off link history tracking. Here‘s how to do it:

1. Open the Facebook mobile app or visit Facebook.com
2. Go to the Menu and select "Settings & Privacy"
3. Click on "Settings" then scroll down to "Permissions"
4. Select "Off-Facebook Activity"
5. Hit the "Clear History" button
6. Most importantly, go to "Manage Future Activity" and toggle "Future Off-Facebook Activity" to OFF

You also have the option to selectively disable tracking for specific apps and websites in your Off-Facebook Activity, but I recommend disabling it entirely. Note that turning this setting off doesn‘t actually delete any previously collected data; it only prevents new data from being associated with your account going forward. To remove historical data, you must manually clear your off-Facebook activity history.

Additional Tips to Safeguard Your Privacy

While opting out of link tracking is a good first step, the unfortunate reality is that Facebook has many other data collection vectors that are difficult to avoid entirely – including tracking logged-out users and shadow profiles of non-users. To further protect yourself, I recommend taking these additional precautions:

• Use a privacy-focused browser: Browsers like Brave and Firefox have built-in tracking protection and other privacy features enabled by default. Avoid Google Chrome, as Google has a similar business model to Facebook.

• Install privacy extensions: Tools like uBlock Origin, Privacy Badger, and Facebook Container can help block trackers, limit Facebook‘s ability to track you around the web, and prevent it from linking your off-site activity to your Facebook identity.

• Utilize a reputable VPN: A high-quality VPN like ProtonVPN or Mullvad can mask your IP address and encrypt your traffic to help anonymize your web browsing (but be wary of free VPNs, which often have poor security and privacy practices).

• Minimize Facebook data sharing: Go through your Facebook privacy settings and turn off any unnecessary data sharing, like your relationship status, employer, education, etc. Be judicious about what photos, posts, check-ins and personal info you share as well.

• Enable two-factor authentication: Facebook offers 2FA via an authenticator app or U2F device to help protect your account from unauthorized access. Avoid using your phone number as Facebook uses it for ad targeting.

• Don‘t use Facebook to log into other sites/apps: Using Facebook Login gives the company access to even more information about your activities on third-party services. Create unique logins for each service instead.

• Consider leaving Facebook/Instagram entirely: This is the ultimate way to cut off Facebook‘s data collection at the source. If you‘re not ready to #DeleteFacebook, consider deactivating your account or only accessing it via a mobile browser.

The Bottom Line

In the age of surveillance capitalism, protecting your privacy requires constant vigilance and proactive effort to opt-out of pervasive data harvesting by companies like Facebook. Users must educate themselves on the many ways their personal information is collected and monetized, often without meaningful consent or transparency. As a cyber security expert, I cannot emphasize enough the importance of controlling access to your data and exercising your privacy rights.

While Facebook provides some steps to limit tracking and data sharing, they are often hard to find and use. The company has repeatedly demonstrated through its actions that it prioritizes profits over user privacy, and will likely continue to push the boundaries of acceptable data collection until reined in by strict regulations.

Ultimately, it‘s up to individuals to take responsibility for their online privacy and make informed choices about which services they use and what information they share. Turn off invasive settings like link history tracking, lock down your privacy settings, use privacy-preserving tools, and consider cutting ties with companies that don‘t respect your data. Your personal information is valuable – don‘t let Facebook and others exploit it for their gain.