Facebook has started encrypting links to counter privacy-enhancing URL stripping

Facebook started using a different URL scheme for site links to combat URL stripping technologies that browsers like Firefox or Brave use to improve privacy and prevent user tracking.

Some sites, including Facebook, add parameters to the web address for tracking purposes. These settings have no user-relevant functionality, but sites rely on them to track users across pages and properties.

Mozilla introduced support for URL removal in Firefox 102, which it launched in June 2022. Firefox automatically removes tracking settings from web addresses, but only in incognito mode or when the protection feature against browser tracking is set to strict. Firefox users can enable URL stripping in all Firefox modes, but this requires manual configuration. Brave Browser also removes known tracking parameters from web addresses.

Both web browsers use lists of known tracking parameters for functionality. Lists should be updated whenever sites change tracking settings.

Facebook could have changed the scheme it uses, but that would have given Facebook only temporary recourse. It looks like Facebook is now using encryption to track users.

Previously, Facebook used the fbclid parameter for tracking purposes. Now it uses URLs like https://www.facebook.com/ghacksnet/posts/pfbid0RjTS7KpBAGt9FHp5vCNmRJsnmBudyqRsPC7ovp8sh2EWFxve1Mk2HaGTKoRSuVKpl?__cft__[0]=AZXT7WeYMEs7icO80N5ynjE2WpFuQK61pIv4kMN-dnAz27-UrYqrkv52_hQlS_TuPd8dGUNLawATILFs55sMUJvH7SFRqb_WcD6CCOX_zYdsebOW0TWyJ9gT2vxBJPZiAaEaac_zQBShE-UEJfatT-JMQT5-bvmrLz7NlgwSeL6fGKH9oY9uepTio0BHyCmoY1A&__tn__=%2CO%2CP-R instead.

The main problem here is that it is no longer possible to remove the tracking part of the URL, because Facebook has merged it with part of the required web address. Deleting the entire construct after the ? would open the main Ghacks Technology News Facebook page, but it will not open the linked post.

Since it is no longer possible to identify the tracking part of the web address, it is no longer possible to automatically remove it from the address. In other words: Facebook has the edge when it comes to URL-based tracking at the time, and there’s not much you can do about it unless you find a way to decipher the information.

Closing words

There is currently no option to prevent Facebook from tracking users via links. Users could avoid Facebook, but this may not be possible all the time. URL tracking does not help much if other means of tracking, for example via cookies or site data, are not available. Although Facebook obtains some information from URL-based tracking, it cannot link it if no persistent data is available.

Users who don’t log in to Facebook and regularly clear cookies and site data can avoid most company tracking.

Now you: what do you think of this development? Start of a game of cat and mouse, or game over for privacy already? (thanks NJ)

Summary

Facebook has started encrypting links to counter privacy-enhancing URL stripping

Article name

Facebook has started encrypting links to counter privacy-enhancing URL stripping

The description

Facebook started using a different URL scheme for site links to combat URL stripping technologies that browsers use to improve privacy and prevent user tracking.

Author

Martin Brinkman

Editor

Ghacks Technology News

Logo

Advertising

Comments are closed.