"Localhost tracking" explained. It could cost Meta €32B

Summary

Meta devised an ingenious system (“localhost tracking”) that bypassed Android’s sandbox protections to identify you while browsing on your mobile phone — even if you used a VPN, the browser’s incognito mode, and refused or deleted cookies in every session.Next, we preview what may (and should) become the combined sanctioning smackdown of the century, and then we explain — in simple terms (because it’s complicated) — what Meta was doing.Meta faces simultaneous liability under the following regulations, listed from least to most severe: GDPR, DSA, and DMA (I’m not even including the ePrivacy Directive because it’s laughable).GDPR, DMA, and DSA protect different legal interests, so the penalties under each can be imposed cumulatively.The combined theoretical maximum risk amounts to approximately €32 billion** (4% + 6% + 10% of Meta’s global annual revenue, which surpassed €164 billion in 2024).Maximum fines have never before been applied simultaneously, but some might say these scoundrels have earned it.If you want to go straight to the breakdown of infractions and penalties, click here.You’re reading ZERO PARTY DATA. The newsletter about the crazy crazy world news from a data protection perspective by Jorge García Herrero and Darío López Rincón.In the spare time this newsletter leaves us, we like to solve complicated issues about GDPR & AI Act. If you’ve got one of those, give us a little wave. Or contact us by email at jgh(at)jorgegarciaherrero.com. Below is a simplified explanation of a very technical process, rigorously detailed on the website set up by the researchers who uncovered Meta’s latest major blow to the GDPR specifically, and to other regulations more broadly, as we’ll see.Credit where it’s due — it’s ingenious. Ingenious in the sense of breaking (yet again) the record for a privacy-related fine, but hey!... ingenious.This is the process through which Meta (Facebook/Instagram) managed to link what you do in your browser (for example, visiting a news site...