I recently had an interesting observation concerning the Instagram app and the account matching algorithm(s) that Facebook uses and would like to ask for your opinions.<p>Following scenario:
I have an iPhone X running iOS 11.3.1 with FB Messenger and Whatsapp installed, but not the Facebook app. Messenger doesn't have access to my contacts but WhatsApp does. A couple days ago I installed Instagram from the App Store and created an IG account using an email like this <lots_of_gibberish>@<domain>.com (I have a catch-all setup for this domain). I didn't give IG access to my contacts, didn't provide my phone number nor connected it to Facebook.<p>At first the suggestions for new contacts in IG were completely random. However, after about 20-30 seconds the list of suggestions updated and showed me IG accounts of friends on Facebook.<p>I repeated this experiment, deleted / installed the app, checked the iOS privacy controls, made sure not to enter the phone number or allow access to contacts, and again, I got the same account suggestions from FB friends.<p>I don't undestand how Facebook / Instagram is able to pull this off. The Instagram account email hasn't been used at all before, the app doesn't have access to my contacts and doesn't know my phone number. AFAIK iOS apps are sandboxed and can't fingerprint the device nor access each others cookies? So that leaves matching by IP and / or location, however in a large building that would be quite inaccurate?<p>So how does Facebook do this?
Your device has a several unique IDs that can used by apps to link your "profile" across unrelated services. Most likely <a href="https://developer.apple.com/documentation/adsupport/asidentifiermanager" rel="nofollow">https://developer.apple.com/documentation/adsupport/asidenti...</a>
Most likely some sort of fingerprinting of your device..<p>Since you use three different facebook services as well providing the access to phone number of the device to whatsapp, facebook has a pretty solid idea who the device belongs to.<p>This is an opinion not a fact but is something that is extensivly used to identify returning users (on i.e. different browsers / devices etc.) To services