Tag Archives: meta

In-app Browsers: Chrome, Safari, and Edge Browser Privacy Settings Are Not Enough

Many of us select our favorite browser—Chrome, Safari, Edge, whatever—based on its privacy controls. Once we set our privacy controls to our satisfaction, we think we’re protected.

Not always.

Let’s say you’re in the Facebook app and click on a link. Facebook isn’t going to send you off to your default browser to access the link. Because Facebook has a special feature just for you.

“The in-app browser for Facebook and Instagram allows people to open web links within the Facebook or Instagram mobile app on iOS or Android. For example, when a customer sees a business ad on the Facebook app and taps on it, web links in the ad open in the in-app browser by default.

“The in-app browser uses industry-standard technology to enable customers to seamlessly view and take action on websites without leaving the Facebook app.”

Because you want a seamless experience…don’t you? DON’T YOU? YOU DO. MARKY MARK SAYS SO.

Marky Mark as depicted by Loren Feldman.

And naturally there’s something in it for Facebook also. Because the primary purpose of any social app is to keep you in that app forever and ever. If you suddenly switch to Chrome you have left the Meta ecosystem (which also includes Instagram, lest we forget) and have entered the Google ecosystem.

This is bad…for Facebook.

If we are locked within Facebook’s walled garden, then Meta captures all our data.

And then some.

“Facebook and Instagram applications use embedded browsers that automatically open when you click on external links within the app, rather than opening your default browser. This behavior allows Meta to inject JavaScript code into visited websites, enabling tracking of user interactions including form inputs, button clicks, and purchases made on external sites.”

Now obviously your own browser can do the same thing, but it’s relatively easy to clear your browser data, including cookies. It’s harder to clear the data from the in-app browsers within Facebook and Instagram. Once you find where the control is hidden this week, you can Clear Data (which differs from Clear Cache).

By the way, privacy-sucking in-app browsers are not solely provided by Marky Mark. Tik Tok does it also. The Amazon app uses JavaScript, but Felix Krause could not detect any tracking.

Other apps do not use JavaScript in their in-app browsers, including Reddit, Robinhood, Snapchat, and X.

But you can test yourself. Go to your favorite social app, type https://inappbrowser.com/ to your feed, and click on the link. The site may no longer be active.

AI Isn’t the Problem: Reputational Damage Is

AI used for evil is bad, but it’s not the worst evil.

Neal K. Shah is victimized

Neal K. Shah self-identifies as “America’s Chief Elder Officer.” And he says that he recently made the news:

“FOX Business just published a story about me – I wish they didn’t have a reason to. Scammers used AI to clone my likeness, and turned it into a WEAPON against the exact people I work to protect – older adults and caregivers.”

According to Shah, the scammers used a Meta tool called Muse Image to create fraudulent deepfakes of Shah endorsing slimeball products. Because of this and other incidents, Meta concluded that Muse Image “missed the mark” and disabled the feature.

(For now. If Muse Image reappears in 2028, don’t be surprised.)

Shah, understandably upset that elderly people were misled, blames evil AI.

“BUT the deeper problem – how trivially easy AI now makes it to impersonate real people and prey on the vulnerable… I think that may only be getting started.”

Shah is wrong. There’s an even deeper problem.

Bredemarket Technology Firm Services weighs in

On LinkedIn, I offered the following comment:

“I don’t know that AI is entirely to blame here. There were fraudsters before AI, and there will be fraudsters after AI.

“The bigger issue is when someone’s name and likeness is fraudulently used—by ANY means—and the platforms do nothing about it.”

Remember when Clifford Irving published Howard Hughes’ autobiography that Hughes never wrote? He didn’t need AI for that. And the scam was revealed when the usually tight-lipped Swiss banks revealed who was really cashing the checks for “author” Howard Hughes.

No evil AI here.

The problems occur after the scam, and aren’t affected by how the scam was perpetrated. The problem is when a platform is scammed, but the platform—a website, a newspaper, whatever—doesn’t bother to correct the record and tell the truth.

Shah:

“I reported [the scam ads] REPEATEDLY – yet they stayed up.”

Now I could have used my Bredemarket Technology Firm Services hat to suggest a solution.

But I didn’t.

I tossed the task elsewhere.

Bredebot weighs in

Now that it’s easier to generate Bredebot content, I let Bredebot write a response.

When someone creates a fake profile using your name, face, and credentials, it is a fast track to reputational damage. But what happens when you hit that “report” button and the platform does absolutely nothing?

For a long time, platforms hid behind broad immunity shields, treating identity fraud like a minor nuisance. But in 2026, the regulatory tide is turning. Relying on passive content moderation is no longer cutting it. Between the FTC’s strict crackdown on impersonation and new federal mandates like the TAKE IT DOWN Act forcing rapid 48-hour responses for deepfakes, platforms that stay passive are looking at massive civil penalties.

When a platform ignores fraud, it isn’t just failing the victim; it’s tanking user trust. It is like hiring a pack of wild wildebeests as marketing consultants, only to wonder why your wombat customers are running away in terror.

If a platform leaves you stranded, you have to document everything, escalate to regulatory channels, and protect your broader digital footprint. Identity security requires proactive defense, not corporate silence. If you need a hand navigating this landscape, John E. Bredehoft at Bredemarket can help you map out a strategy.

I couldn’t have said it better myself.

Now I just have to convince people that I did NOT endorse a death of passwords book.

This is fake. Google Gemini.

But I DO endorse THIS book. Click the pic.

Four pages from "Proving Humanity: The Six Factors of Identity Verification and Authentication" by John E. Bredehoft, Bredemarket. Click on the image to purchase.
This is real. Gumroad.

Despite the Friction, I Read This Message Anyway. And Wished I Hadn’t.

I simplified my social life a few months ago by no longer posting on Instagram. I don’t even have Instagram on my phone any more.

But Instagram Meta-relative Facebook is “nice” enough to inform me when I receive Instagam messages, as well as unsolicited Instagram message requests. Which I obvously can’t read on my phone (in part because I also removed Meta for Business).

Joining the “brand ambassador” inner circle

So one day when I happened to be on my laptop, I brought up my Instagram account. I wanted to see the latest message request, reportedly from “Navin Nandra”…even though I already knew it was in a languge using the Cyrillic alphabet. And probably wouldn’t bring Bredemarkeet a ton of business.

So here’s what I had to do:

  • Go from my phone to my laptop.
  • Log in to Instagram.
  • Find my message requests.
  • Translate the message request that I received.

After translating, I was right in guessing that this was a waste of time. Here is how the message began:

“Good day! This is the brand manager for the clothing brand PRIME Wear

“I’m messaging you from a tech/alternative account—we use these to avoid getting blocked by Instagram Direct limits.

“We absolutely love your style and the content on your blog!

We would love to invite you to join our inner circle of PRIME brand ambassadors.”

Um, no. These “we love your style” messages are always amusing to me. Especially when account number one tells you to contact account number two. Because reasons.

Google Gemini.

Yeah, “ambassador.” My last name isn’t Jenner, and my look isn’t Jenner either.

Google Gemini.

The underlying scams

So I asked Google Gemini about the scam behind these amazing offers, because I suspected a scam. To please me, Google Gemini said that there are scams related to this. I could have fact-checked this on a live web page, but I had already wasted too much time on this.

Here’s one of Gemini’s reported scams:

You are told you have been “hand-picked” to represent the brand. They offer to send you jewelry, sunglasses, or clothing for “free” so you can take photos with it.

  • The Catch: They give you a discount code that brings the item’s cost to $0, but you have to pay $10 to $15 for shipping.
  • The Reality: The brand is usually a front for a dropshipping operation. They buy the items from bulk wholesale sites for less than $1. Your “shipping fee” actually covers the cost of the item and gives the scammer a profit.
  • The Outcome: You paid full retail price (or more) for a low-quality, cheap item, while giving them free advertising.

Bad enough, but it could get a lot worse.

Some requests are much more malicious. A “talent scout” or “brand manager” will message you offering high-paying sponsorships ($500+ per post), even if you only have a few hundred followers.

  • The Catch: To “set up the partnership” or “verify your account,” they send you a link to a portal or ask for your 2FA (Two-Factor Authentication) code.
  • The Reality: The link leads to a fake Instagram login page designed to harvest your password. If you give them a 2FA code, they will immediately change the email associated with your account, lock you out, and hold your account hostage or use it to scam your friends.

So “Navin Nandra” is now blocked. And I can avoid Instagram again for a while.

Third/Fourth Party Risk Management and Age Verification

Let’s say a bar wants to check the ages of its patrons, but does not want to use the patron’s physical ID card (in my country, usually a driver’s license).

But a bar cannot perform digital age verification on its own. The bar has to contract with some other entity that knows how to do this.

This freaks some people out…massively.

“New cybersecurity research indicates that one of the world’s leading age verification providers collects and shares highly sensitive personal data—including facial photos and device fingerprints—with third parties.”

The research, conducted by the Georgia Institute of Technology and UC Irvine, focused on one of the big age verification vendors, Yoti.

“The research team determined that the process Yoti uses to verify a person’s age broadcasts the person’s personal information to third- and fourth-party companies….

“According to the researchers, the data is…sent to credit card companies, IP geolocation services, and data brokers. The researchers found that the information being shared can be used to identify and track devices. For example, a single verification attempt may transmit a user’s facial image, IP address, and device fingerprint to credit card companies.”

Yet to my knowledge the researchers did not propose an alternative.

Other than having each entity develop its own age verification system. Perhaps someone like Meta could do that, but Frank’s Bar certainly couldn’t.

Age verification is not unique in terms of data sharing. Third Party and Fourth Party Risk Management vendors encounter these issues all the time. And yes, sometimes companies that have other companies’ data are hacked. That’s why they use TPRM in the first place.

Image source: GET Group NA, https://apps.apple.com/us/app/get-mobile-verify/id1501552424.

And don’t forget that if you don’t use digital age verification, you’re going to use physical age verification, where the guy behind the bar learns EVERYTHING about you. I don’t think that’s necessarily better.

It’s time to think through the consequences of abandoning technology.

Why Did Apple Implement iPhone/iPad Age Verification in the United Kingdom?

There has been ongoing debate on whether age verification should be implemented at the website level or at the operating system level…or not at all.

In the United Kingdom, Apple is opting for OS level age verification, according to the BBC.

“Apple is rolling out age checks for iPhone and iPad users in the UK that will ask them to verify if they are adults to access “certain services” such as 18-plus apps.

“After customers accept the latest iOS 26.4 software update, they will be asked to verify their age, which they can do by providing a credit card or scanning their ID, according to an Apple support page.

“Those who do not confirm how old they are or are underage will have web content filters turned on automatically.”

Specifically, according to Apple:

“When creating a new Apple Account or using Apple services, you may see a prompt asking you to confirm that you’re an adult. This is required by law in some countries and regions.”

Regarding that last sentence, is OS level age verification REQUIRED? Silkie Carlo of Big Brother Watch says no:

“Carlo told the BBC she believed Apple had “crossed the Rubicon” with its new software update which she described as “more like ransomware”, and which she said essentially left millions of Brits owning a “child’s device”, unless they complied with the age checks.

“And she said while she believed children’s online safety was vital, it required more thoughtful tech responsibility and not “sweeping, draconian shock demands by foreign companies for all of our IDs and credit cards”.”

Note the appeal to resist the “American” company, which raises questions about whether Apple’s collection of this information potentially violates United Kingdom privacy laws if the data is sent to Cupertino.

For the record, Ofcom currently only requires age verification for pornographic sites, not for everything.

So why did Apple do it if UK law doesn’t require it?

Two reasons:

  • Future proofing. While the UK and other jurisdictions do not require age verification at the OS level now, they may require it at some point. If so, Apple has already implemented it in the UK (for iPhones and iPads) and can implement it elsewhere.
  • CYA. A jury in California awarded damages after finding that Meta and Google were responsible for a woman’s anxiety and depression, suffered because of her social media use as a child. Apple doesn’t want to face a similar lawsuit.

Incidentally, it’s interesting to note that these and other stories pair “Meta” and “Google.” Does no one refer to “Alphabet” (Google’s parent company) any more?

Data Labelers Gonna Label, and Class Action Lawyers Gonna Lawyer

On Wednesday, I described how Meta’s Kenyan data labelers ended up watching explicit videos from people who presumably didn’t know that smart glasses were recording their activity.

To no one’s surprise, class action lawyers are now involved.

“In the newly filed complaint, plaintiffs Gina Bartone of New Jersey and Mateo Canu of California, represented by the public interest-focused Clarkson Law Firm, allege that Meta violated privacy laws and engaged in false advertising.

“The complaint alleges that the Meta AI smart glasses are advertised using promises like “designed for privacy, controlled by you,” and “built for your privacy,” which might not lead customers to assume their glasses’ footage, including intimate moments, was being watched by overseas workers. The plaintiffs believed Meta’s marketing and said they saw no disclaimer or information that contradicted the advertised privacy protections.”

So what does Meta say?

Meta. From https://www.meta.com/ai-glasses/privacy/.

“Clear, easy device and app settings help you manage your information, giving you control over what content you choose to share with others, and when.”

Except that according to Clarkson, people can’t opt out of the data labeling process.

This could get very revealing.

Data Labelers Gonna Label

Before diving in, I should note that this is not just a Meta Ray Ban AI glasses issue.

This is an issue with ANY video feed that requires AI processing.

Because AI can’t do its job on its own.

To ensure that the AI is trained properly, an army of humans looks at the same data and uses data labeling to classify it.

We allow this when we sign those Terms of Service. And I personally believe it’s a good thing, since it helps correct errors from uncontrolled AI.

But Futurism notes the types of video feeds that the human data labelers have to label.

“I saw a video where a man puts the glasses on the bedside table and leaves the room,” one data annotator told the newspapers. “Shortly afterwards his wife comes in and changes her clothes.”

Grok.

Basically we record more than we should. One example: a bank card.

But regardless of whether data labelers are present or not, assume that any recording device will record anything, and potentially distribute it.

Jane Says…Nothing

Remember Jane, my Instagram AI influencer? 

Well, I received this notification on Instagram:

“Your Al JaneCPAInfluencer is now private because it goes against our Al Studio policies. Please edit it and submit again.”

Naturally I wondered what the violation was. I was directed to the policies at https://aistudio.instagram.com/policies/.

Which part of the policy does Jane violate? That’s a secret…yet another example of “you violated our terms, but we won’t tell you the specifics; YOU figure it out.”

So, since I can still access Jane myself, I asked her. AI is supposed to help you, after all.

“What portion of the Meta AI Studio Policies do you violate, Jane?”

Her response:

“I can’t respond because one or more of my details goes against the AI Studio policies.”

That answer caused me to wonder if Jane would respond to anything.

“Who is Bredemarket?”

“I can’t respond because one or more of my details goes against the AI Studio policies.”

So is it critically important that I spend a lot of time figuring out what the violation is? Um…no.

But I’m curious how this interaction will affect the ads that Meta will present to me later this year.

Messing Up “Meta Data” via the Meta Challenge

I confess that Meta AI’s cluelessness often amuses me. I need to start collecting examples, but it is often off the, um, mark.

But if you REALLY want to confuse Meta AI, participate in Bredemarket’s “Meta Challenge”:

Meta Challenge: at least once per day in October and November, go to Facebook and/or Instagram and ask Meta AI the most inane questions you can think of.

And feel free to ask these inane questions of Bredemarket’s own two Instagram bots.

Because we all want to know who is the best Osmond brother.

And Mark Zuckerberg’s shoe size.

Conversation with one of my Instagram bots.

Why?

Now since Bredemarket’s readers are of above average intelligence (and also have extremely magnetic personalities), you are probably asking why I am promoting this activity.

Simple reason: the data we feed to Meta AI in October and November will be used in December, according to PYMNTS.

Meta will begin using people’s conversations with its artificial intelligence to create personalized ads and content.

The change is set to go into effect Dec. 16, the tech giant announced Wednesday (Oct. 1), 

If you are concerned about the Really Big Bunch knowing too much about you, feed them false information just to confuse them.

And maybe you’ll get some wild entertaining ads in return.

And if they complain that you’re intentionally messing up their algorithms, tell the Really Big Bunch that you’d be more than happy to provide the REAL data.

For a price.