Those are good, but they don't work for what the GP is talking about. I'm seeing games/apps associated with my FB account even though I never logged in to FB with them or gave them any info. I literally just opened the app and that activity was associated with my FB account.

I have no idea how they're doing this, since they didn't even request storage access (or I didn't give it). Can any Android developer here chime in on how an app can figure out my Facebook ID even though I don't even have Facebook installed on my phone and didn't give any sort of credential or access to the app?

I think they cross-reference Android Advertising ID in their SDK. Have you ever logged to Facebook from your phone?

https://developers.facebook.com/docs/app-ads/targeting/mobil...

I have, either in the browser or in Swipe (a third-party app). I've never logged in to or installed the Facebook app or Messenger.

Try to opt out of Advertising ID (Settings -> Google -> ads) and see if apps continue to be associated with your facebook account. I suspect Swipe sent both your account ad advertising id during login.

I opted out of Google advertising a long time ago, I think in the end it was Instagram/WhatsApp that did the dirtywork.

Then FB left behind tracking data, and there's your link. Sigh.

How? It was running in a browser.

Once you've logged into facebook from the device, they likely created a device fingerprint for your device: https://en.wikipedia.org/wiki/Device_fingerprint . This would allow them to identify you even without a cookie or ad id to correlate against.

I don't think the browser fingerprint and native app fingerprint are the same, what you say sounds unlikely to me.

Fingerprinting across devices is possible too, using things like behavioral analytics, network traffic, timing, third-party data sources etc.

The third party data sources is the easy one. Log into service A on your computer and service A on your phone. Service A fingerprints both and sells the data to service B. Now service B knows how to correlate your behavior between devices even though you never logged in.

I’m sure you’ve logged in something on both your phone and computer. It doesn’t have to be Facebook.

Maybe same phone number on Google Play and Facebook or some other way the phone number IDs you?

Edit: This report[1] puts the blame mostly on Google ads ID.

[1] https://privacyinternational.org/report/2647/how-apps-androi...

That's possible, though if any app can get my number without asking for any permission I'm going to throw my phone away.

Are you using Instagram or WhatsApp?

Ahh, there we go, I forgot about those... That must be it, thanks.

The whole point of them buying WhatsApp was to have a backdoor into people's contacts (among other things).

I found a mere four items in my activity list, all from several months ago, probably when I mistakenly used the wrong container or had uBlock turned off. It's nice to see all my anti-tracking software is working!

I use Firefox Containers to limit and logged in FB activity to that & never log in using FB other than FB website itself. I have no FB apps (including WhatsApp).

I've been running uMatrix for a few months.

My firefox tracking-prevention (similar to EFF's one, but probably not as good) is always using maximum privacy settings.

I still have a few sites appear... AND for websites I've never even visited (that I'm aware of, & I'm the only user of this machine)

There seems to be some serious fingerprinting going on, more than simple cookies.

Agreed, even with all of the above I had about 15 or so sites in that Facebook list. I suspect it's because I was logged in to Facebook on my phone's browser for a while. Not sure why I even did that...

I thought Google Analytics had a decent privacy policy that would prevent Google from doing anything with GA data. But I remember some fuzzy wording like "your data" which could simply mean that Google considers GA data to be their data.

Has anyone done a good deep dive on what Google actually does with GA data?

Even before firefox containers, I used a dedicated profile for facebook only as well as using privacy badger and ublock origin. Facebook still collected data about me from external sites. I think mainly through my phone, possibly through linking phone number or email addresses.