Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google, Microsoft, Meta All Tracking You Even When You Opt Out

404media.co

Post reply on HN
Print view View original

81–90 of 102 posts

Re: Google, Microsoft, Meta All Tracking You Even When You Opt Out

#81

Post by tlibert »

Zetaphor wrote: post #77
tlibert wrote: post #28

Earlier quoted context omitted.

Just update the codebase, much easier, 10 minutes.

That entirely ignores and excuses the chain of decisions that lead to this problem. Removing it from the codebase today does nothing to dissuade them from doing something similar tomorrow

That's why webXray (https://webxray.ai) has perfected forensic privacy auditing - we catch every code change that has visible traces. I'll catch the same thing any way you do it - cookies, local storage, js obfuscated network payloads...no sweat. I'll go all day long.

Re: Google, Microsoft, Meta All Tracking You Even When You Opt Out

#82

Post by tlibert »

Zetaphor wrote: post #78
tlibert wrote: post #24

Earlier quoted context omitted.

If a user has an "opt-out" button or signal it should be wired up to a system that functions as such. This is just a software engineering, you could vibe-code a fix in ten minutes.

You are assuming this was simply a development oversight and not part of a larger systemic issue

Oh, I very much am not.

Re: Google, Microsoft, Meta All Tracking You Even When You Opt Out

#84

Post by rolph »

BizarroLand wrote: post #80
wnevets wrote: post #49

Earlier quoted context omitted.

> fines that amount to a daily expenditure account, do nothing. Even those relatively small fines rarely get paid. Companies can tie up the judgements in the courts for years without having to pay a single cent. [1] > The Data Protection Commission (DPC) is owed more than €4 billion in fines that have not been collected or are subject to legal challenge. The DPC hit companies – including firms in Big Tech – with more…

Hopefully they hold off until the financial straw breaks and then they leverage their owed fines to claim ownership of these shithole companies completely. I know I'm dreaming, but still.

" are you enjoying the party?"

" yes, havn the time of my life !"

"heres your bill."

"whaa aat ?!"

" oh, did you think it was all free, when everyone normal, pays ? "

Re: Google, Microsoft, Meta All Tracking You Even When You Opt Out

#85

Post by nostrademons »

tlibert wrote: post #20
rolph wrote: post #5

they have no fear of the current financial incentives, there has to a punitive quantity involved, and the mentality of any regulators has to catch up with present day. fines that amount to a daily expenditure account, do nothing. fines have to have potential to do real damage to, or destroy noncompliants, if there is going to be any deterrent. contempt, is obvious, the chance of jail should exist in actuality, rather…

If you read the report this is why I say network traffic with a Sec-GPC: 1 (GPC opt-out) should return a 451 automatically instead of a cookie, and how the Meta Pixel code can wrap a GPC conditional around execution. That's why they are terrified - fines don't matter, code does.

That's a terrible idea though. It means that anyone who selects the "Do not track me" option will find that they can't access the content at all, which will quickly train users to never select "Do not track me".

Re: Google, Microsoft, Meta All Tracking You Even When You Opt Out

#86

Post by tbrockman »

nostrademons wrote: post #79
tlibert wrote: post #68

Earlier quoted context omitted.

We run scientific audits that provide evidence of specific data transfers under specific network conditions.

Your marketing should specifically say "We track cookies" (or if you wanna get punchy about it, "We track cookies so cookies don't track you") so potential customers know exactly what they're getting. For the purposes of legal compliance, this is pretty irrelevant. There may be people that want to know that the existing laws and company's compliance to them doesn't actually stop the cookies from being sent, but your…

Do you have any legal experience, evidence, or case history to support your perspective? You assert that the statement "Our findings reveal major technology companies simply ignore globally defined opt-out signals, raising the spectre of industrial-scale non-compliance with California requirements" is untrue -- how do you know? Do you think everything found in the discovery process would agree? Do you think a company with a history of privacy violations would actually go through with a lawsuit where they'd have to definitively prove they don't? What about proving malice, that webXray knew their statements were false or acted with reckless disregard for their truth? What about the risk of filing a suit where California's anti-SLAPP statue would probably apply?

Re: Google, Microsoft, Meta All Tracking You Even When You Opt Out

#87

Post by 1vuio0pswjnm7 »

Meta's WhatsApp app under certain network conditions will try to bypass Android VPN settings using Google Public DNS servers even when (a) the OS settings "Always-on VPN" and "Block connections without VPN" are enabled, (b) port 53 is forwarded to a local address,^1 (c) DNS settings under "Network details" for the router point to local addresses only and (d) "Mobile data" is disabled for the SIM and the phone has no access to cellular data (e.g., MMS will fail)

Even the Google pre-installed system apps don't do this

Meta's attempts to conduct surveillance go further than ignoring the sec-gpc header. Meta tries to bypass Android's built-in VPN and the system DNS settings

I use a computer I can reasonably control, i.e., one running an OS I compiled myself, as the gateway for the phone so traffic destined for 8.8.8.8 and 8.8.4.4 is blocked by the gateway's firewall. (TLS forward proxy on the gateway also adds sec-gpc header to all HTTP/HTTPS traffic^2)

1. For example, using PCAPDroid or NetGuard

2. In addition to HTTPS traffic, Meta's WhatsApp app sends some requests over unencrypted HTTP, too, e.g., destined for c.whatsapp.net

Re: Google, Microsoft, Meta All Tracking You Even When You Opt Out

#88

Post by wormius »

It's funny that following the link to source https://globalprivacyaudit.org/2026/california

Appends a source-url attribute at the end (404media).

I'm sure they're not doing anything nefarious with it, but it is a tiny bit ironic that there's a referral url like that associated with an organization that is speaking out about global privacy audits.

I'm glad they're doing this, and understand this is complex, but throwing out a "check the plank in thine eye before the sty in the others". I haven't really dealt with referral links like that, IIRC that's something 404 is sending as a referrer URL? Would it be prudent to reroute on the GPA sites such referral urls to strip them before sending back?

Re: Google, Microsoft, Meta All Tracking You Even When You Opt Out

#89

Post by tlibert »

wormius wrote: post #88

It's funny that following the link to source https://globalprivacyaudit.org/2026/california Appends a source-url attribute at the end (404media). I'm sure they're not doing anything nefarious with it, but it is a tiny bit ironic that there's a referral url like that associated with an organization that is speaking out about global privacy audits. I'm glad they're doing this, and understand this is complex, but throwi…

We don’t process it, not our decorator.

Re: Google, Microsoft, Meta All Tracking You Even When You Opt Out

#90

Post by aagha »

1vuio0pswjnm7 wrote: post #87

Meta's WhatsApp app under certain network conditions will try to bypass Android VPN settings using Google Public DNS servers even when (a) the OS settings "Always-on VPN" and "Block connections without VPN" are enabled, (b) port 53 is forwarded to a local address,^1 (c) DNS settings under "Network details" for the router point to local addresses only and (d) "Mobile data" is disabled for the SIM and the phone has no…

Do third party solutions like AdBlock prevent this?
Post reply on HN