Hospitals installed Facebook's tracking pixel on their websites. It sent your medical appointment bookings, the conditions you searched for, and your doctor's name directly to Facebook. Crisis hotlines sent call logs. Tax sites sent income data. The website operators had no idea. Facebook's code collected everything the page contained. Your cancer diagnosis, sent to an advertising company via a tracking pixel. A priest was tracked to gay bars using mobile data from the ad-tech ecosystem. The data came from app SDKs — the same infrastructure Facebook SDK, Google Analytics, and ad networks feed. His Grindr usage was cross-referenced with his phone's location. He was outed. He resigned. The data that destroyed his career started as "anonymous app analytics.".
What they claim: Facebook SDK described as analytics and advertising tools for app developers
What we found: The Markup's "Pixel Hunt" investigation found Meta Pixel and Facebook SDK sending sensitive health data from hospital websites to Facebook — including appointment bookings, medical conditions searched, and doctor names. Tax filing sites sent income data. Crisis hotlines sent call logs. In each case, website operators had installed Facebook's tracking code without understanding what data it collected.
What they claim: Meta describes its SDK as helping developers improve their apps with analytics
What we found: A Catholic news outlet, The Pillar, used commercially available mobile app data — sourced through the data broker ecosystem that Facebook SDK feeds — to track Monsignor Jeffrey Burrill, then-general secretary of the US Conference of Catholic Bishops, to gay bars and his Grindr usage. He was outed and forced to resign. The data trail started with app SDKs collecting location data and ended with the destruction of a career.
What they claim: Meta states users can control data sharing through privacy settings
What we found: The FTC found Meta violated a 2012 consent decree by continuing to collect and use personal data in ways it had promised to stop. The $5 billion fine — the largest privacy penalty in FTC history — specifically cited data collection through Facebook SDK embedded in third-party apps. Apps using Facebook Login or the Facebook SDK sent data to Meta even when users had adjusted their privacy settings to restrict sharing.