# Security & Privacy Scorecard

## Facebook

## Quick Assessment

**5 security concerns requiring attention**

Facebook implements solid security foundations including HTTPS enforcement and biometric authentication, but allows unencrypted connections for analytics domains and collects extensive personal data for third-party advertising. Privacy-conscious users should be aware of the app's comprehensive data collection practices.

## What This Means for You

**Primary Concern:** Your personal information, location data, and financial details are collected and used for third-party advertising with detailed behavioral tracking across multiple services.

**Risk-Based Impact:**

- **High Risk (Network Security):** On untrusted WiFi networks, analytics and telemetry data transmitted to specific Facebook domains could be intercepted by network attackers. This includes session identifiers, device fingerprints, and usage patterns.

  **This applies if:** You use Facebook on public WiFi networks (coffee shops, airports, hotels)

  **For most users:** On your home WiFi with WPA2/WPA3, network exploitation is unlikely. The main app communication remains encrypted via HTTPS.

- **High Risk (Privacy):** Your name, email, phone number, physical address, location data, and financial information are collected and explicitly used for third-party advertising. This enables detailed behavioral profiling, cross-site tracking, and potential exposure in data breaches.

## Recommendation: Use With Caution

Facebook collects extensive personal data (7 PII categories, location, financial info) explicitly for third-party advertising, with high-severity privacy risks. The app's security foundations are solid, but privacy-conscious users should consider the extensive tracking before use. If you value data minimization and privacy, consider alternative social platforms with stronger privacy protections.

**Best For:** Casual users who prioritize social connectivity and accept comprehensive data collection for personalized advertising

**Avoid If:** You are privacy-conscious, handle sensitive professional data, work in regulated industries, or want to minimize your digital advertising profile

## Key Findings

### High Security Risks (2 issues)

1. **Unencrypted Analytics Connections**
   Four analytics domains are configured to bypass security protections and allow unencrypted HTTP connections. On untrusted WiFi networks, attackers can intercept telemetry data including session identifiers and usage patterns.

   **At Risk:**
   - Session identifiers
   - Device fingerprints
   - Usage patterns and analytics data

   **This applies if:** You use Facebook on public, untrusted WiFi networks

   **For most users:** On secure home networks with modern WiFi encryption (WPA2/WPA3), this risk is minimal. Avoid using Facebook on public WiFi without a VPN.

2. **In-App Browser Security Weakened**
   The in-app browser is configured to allow unencrypted connections when loading external links and embedded content. Network attackers on untrusted networks can inject malicious scripts, steal session cookies, or modify displayed content.

   **At Risk:**
   - Session cookies
   - Login credentials on HTTP sites
   - Displayed web content

   **This applies if:** You click external links or browse embedded content while on public WiFi

   **For most users:** Using secure home WiFi reduces this risk. Consider opening external links in your main browser (Safari/Chrome) instead of the in-app browser.

### High Privacy Risks (3 issues)

1. **Extensive Personal Information Collection for Advertising**
   The app collects seven types of personal information (name, email, phone number, physical address, user ID, device ID, other contact info) and explicitly uses them for third-party advertising. All are linked to your identity and tracked across services.

   **At Risk:**
   - Real name and contact details
   - Physical address
   - Phone number
   - Email address
   - Device identifiers

2. **Location Tracking for Advertising Purposes**
   Location permissions are explicitly tied to advertising purposes according to the app's own descriptions. Your precise GPS coordinates and location patterns are collected to deliver targeted ads based on where you go.

   **At Risk:**
   - Precise GPS coordinates
   - Location history and patterns
   - Places you visit regularly

3. **Financial Data Used for Ad Targeting**
   The app collects your purchase history and other financial information and uses it for third-party advertising purposes. This enables financial profiling for targeted advertising and discriminatory pricing.

   **At Risk:**
   - Purchase history
   - Financial information
   - Spending patterns

### Medium Privacy Concerns (2 issues)

1. **Device Fingerprinting Through In-App Browser**
   The in-app browser exposes over 40 data points to websites you visit, including hardware specs, battery status, network metrics, graphics card details, canvas fingerprinting, and font lists. This creates a unique fingerprint that can track you across websites with 99% accuracy, even without cookies.

   **Collected Data:**
   - Hardware information (memory, CPU cores)
   - Battery status and level
   - Network connection details
   - Graphics card information
   - Canvas and font fingerprints

2. **Comprehensive Activity Tracking**
   The app collects 13 types of behavioral data including search history, browsing history, product interactions, advertising data, photos, videos, and contacts—all linked to your identity and used for third-party advertising. Even crash data and performance data are declared for advertising purposes.

   **Tracked Activities:**
   - Search and browsing history
   - Product interactions
   - Photo and video content
   - Contact information
   - App performance and crashes

### Low Priority Items (1 issue)

1. **Cross-App Tracking via Vendor Identifier**
   The app uses a vendor identifier (IDFV) that tracks you across the Meta family of apps (Facebook, Instagram, Messenger, WhatsApp). This tracking persists even if you deny the advertising identifier (IDFA) permission through App Tracking Transparency.

## Privacy Concerns

### What Data is Collected

- Personal information: Name, email, phone number, physical address, user ID, device ID
- Location data: Precise GPS coordinates when using location features
- Financial information: Purchase history and other financial data
- Usage data: Search history, browsing history, product interactions, app usage patterns
- Media: Photos, videos uploaded or viewed
- Contacts: Contact lists if shared
- Device information: Device identifiers, hardware specs, battery status, network details
- Behavioral data: Advertising interactions, crash data, performance data

### Third-Party Data Sharing

**The following third parties may receive your data:**

- Spotify - Integrated music playback functionality
- FFmpeg - Media processing library

Note: While only two third-party libraries were identified, the app explicitly declares that collected personal data is used for "third-party advertising," meaning your information is shared with external advertising partners beyond these technical integrations.

## Understanding the Scores

**Security:** 88/100
**Privacy:** 64/100

### Security Breakdown

- **Data Security:** 100/100 - Strong security practices for stored data including Keychain usage for credentials and biometric authentication. Encrypted iCloud backups protect Messenger data.

- **Network Security:** 85/100 - HTTPS enforced globally with proper TLS validation, but specific analytics domains allow unencrypted HTTP connections and the in-app browser permits insecure content loading.

- **Code Safety:** 99/100 - Modern security practices including exclusive use of WKWebView (no deprecated browsers), proper iOS crypto APIs, and stack protections enabled.

### Privacy Breakdown

- **Data Collection:** 66/100 - Extensive data collection across 7 PII categories, location, financial info, and 13 types of behavioral data. All explicitly declared for third-party advertising purposes.

- **Data Sharing:** 92/100 - Limited third-party SDK integrations (no external analytics SDKs), but collected data is explicitly used for third-party advertising per the privacy manifest.

- **User Control:** 78/100 - Proper App Tracking Transparency implementation with consent flows, but IDFV tracking continues across Meta apps even when IDFA is denied. Full privacy manifest provides transparency.

## Positive Security Features

- ✓ HTTPS enforced by default across all app communications with strong TLS validation
- ✓ Keychain used for secure storage of access tokens and credentials
- ✓ Biometric authentication (Face ID/Touch ID) properly implemented for app access
- ✓ Modern WKWebView exclusively with no deprecated browser components
- ✓ Encrypted iCloud backups for Messenger data protection
- ✓ Standard iOS cryptographic APIs with stack protections enabled
- ✓ No third-party analytics SDKs (uses proprietary Meta infrastructure only)
- ✓ Privacy manifest fully compliant with iOS 18.2 requirements
- ✓ App Tracking Transparency properly implemented with proper consent flow
- ✓ Global App Transport Security policy prevents accidental insecure connections

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Reduced Data Collection for Advertising**
   Consider minimizing the collection of sensitive PII categories (physical address, phone number, financial data) for advertising purposes, or provide opt-out mechanisms beyond standard iOS permissions.

2. **Location Data Separation**
   Separate location data collection for core functionality (check-ins, events) from advertising purposes, allowing users to grant location access without automatic enrollment in location-based advertising.

3. **Third-Party Data Sharing Transparency**
   Provide more detailed disclosure of which specific third-party advertising partners receive user data, beyond the general "third-party advertising" declaration.

### Security Enhancements

1. **Enforce HTTPS for All Domains**
   Remove the HTTP exceptions for analytics domains (od.facebook.com, sb.facebook.com, h.facebook.com, od.fbinfra.net) to ensure all telemetry data is encrypted during transmission.

2. **Strengthen In-App Browser Security**
   Disable NSAllowsArbitraryLoadsInWebContent to prevent the in-app browser from loading unencrypted content, or display clear warnings when loading HTTP sites.

3. **Reduce Fingerprinting Exposure**
   Limit the device fingerprinting data points exposed through the JavaScript bridge to only what's necessary for functionality, particularly sensitive data like battery status and graphics card details.

## Technical Context

**App Type:** Social Networking (Extensive Data Collection)
**Classes Analyzed:** 5133
**Third-Party Services:** 2 identified (Spotify SDK, FFmpeg)
**Context Tags:** social, ads, location, contacts, camera, financial, sensitive_data, behavioral_profiling, third_party_tracking

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on mobile applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Meta Platforms, Inc.
**Version:** 554.0.0
**Analysis Date:** March 27, 2026
**Package:** com.facebook.Facebook

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on iOS app version 554.0.0 analyzed on March 27, 2026
- May not reflect server-side security controls
- Cannot detect all runtime behaviors
- Third-party data sharing may extend beyond identified SDKs

For questions about this analysis or to report updates, visit canitrustthat.com.