Meta Allegedly Bypassed Apple's Privacy Rules to Track You Anyway

When Apple introduced App Tracking Transparency in 2021, it promised users a simple choice: allow apps to track you across other apps and websites, or deny that permission. The feature wiped an estimated $230 billion from Facebook's parent company Meta. Now a former Meta employee alleges the company found ways to keep tracking users even after they said no.

The Allegations

Samujjal Purkayastha, a former Meta product manager, filed legal complaints alleging the company used a technique called "deterministic matching" to track users across Facebook and Instagram even when they had explicitly denied tracking permission through Apple's privacy controls.

The allegations, now part of an employment tribunal in London, suggest Meta may have used internal data methods to continue monitoring user behavior despite Apple's rules requiring consent for cross app tracking. Purkayastha claims he was terminated after raising these concerns internally.

What Is Deterministic Matching?

Traditional cross app tracking relies on device identifiers like Apple's IDFA. When users opt out through App Tracking Transparency, apps can no longer access this identifier. The tracking should stop.

Deterministic matching takes a different approach. Instead of relying on external tracking mechanisms, it links user identities using internal data from Meta's own ecosystem. Because this data comes from within Meta's platforms rather than external trackers, it potentially circumvents the technical restrictions Apple designed to protect user privacy.

In practice, Meta could allegedly match your Facebook profile to your Instagram activity to your WhatsApp contacts, building a comprehensive picture of your behavior without ever touching the tracking mechanisms Apple blocks.

Additional Allegations

The complaint includes additional accusations beyond tracking circumvention:

• Meta allegedly inflated ad performance metrics for its "Shops Ads" product by including taxes and shipping costs in conversion value calculations, potentially boosting reported return on ad spend by up to 19%
• The company allegedly used $160 million in internal subsidies to promote the ad product and misrepresent its actual market success

If substantiated, these practices would undermine both user consent frameworks and advertiser trust in reported metrics.

The Broader Pattern

This is not the first time Meta has faced accusations of circumventing privacy controls. The company has invested heavily in developing alternative tracking methods since Apple's privacy changes took effect. Its Conversions API allows advertisers to send customer data directly to Meta's servers, bypassing browser based privacy protections.

The fundamental tension is clear: Meta's business model depends on tracking user behavior to serve targeted ads. Privacy controls that actually work threaten billions in revenue. The company has strong financial incentives to find workarounds, even when those workarounds undermine the choices users believe they are making.

What This Means for Users

The allegations highlight a troubling reality about privacy settings: they may not do what users think they do. When you tap "Ask App Not to Track" on your iPhone, you expect tracking to stop. If companies can simply route around these controls using internal data, the privacy choice becomes meaningless.

This pattern extends beyond Meta. Any company with multiple apps or services can potentially use internal data matching to build user profiles without triggering external privacy controls. The tracking happens within their ecosystem, invisible to both users and the operating system protections meant to prevent it.

For users who genuinely want to limit tracking, the only reliable approach is to limit the data you provide in the first place: use fewer apps from the same company, avoid logging into services with social accounts, and treat privacy settings as one layer of protection rather than a complete solution.