Meta/Facebook: what can an app send without a Facebook screen?

What is embedded in the app?

The Facebook Android SDK is a library that connects apps to Meta services. Different modules have different jobs: App Events measures activity, while Audience Network supplies advertising. A real social-login or embedded-content function is another role again. The presence of the Facebook name alone does not tell us which module runs. Official Android SDK source.

An app event is a record such as opening the app or making a purchase. It can be submitted explicitly by app code or collected through an automatic SDK feature. An advertising ID is a device advertising identifier; an SDK can also maintain other identifiers, so removing that one value does not by itself stop events.

Why does “I never logged into Facebook” not settle the question?

Hypothetical example: a weather app includes a purchase-event call and an installation-level ID. It can invoke that call without ever showing a Facebook login screen. This illustrates a technical distinction between using a social account and an app communicating with the service; it is not a captured purchase from your phone.

Privacy International's December 2018 investigation used traffic inspection to show automatic Facebook SDK transfers in other Android apps, including without Facebook login. That historical investigation explains why startup and automatic collection deserve scrutiny. It does not establish what these inspected 2026 versions transmitted. Privacy International investigation.

What did we find in the weather apps?

Buienalarm 4.32.0 has App Events startup/consent paths, purchase-related consumers and a separate executable Audience Network asset. Its patch disables providers and consent re-enablement, supplies an inert logger where app startup expects an object, stops the identified consumers and removes the advertising asset. The exact Meta upload host was not pinned in that audit. Pinned Buienalarm audit.

Weeronline 3.61.0 has a startup provider, a consent controller enabling collection and a purchase logger. These paths and optional advertising-ID collection are suppressed. The SDK constructs Graph destinations; an explicit graph.facebook.com reference also serves functional Instagram content. Blocking the whole host would have a broader effect than stopping app events. Weeronline audit, destination evidence.

What remains uncertain?

The findings identify code paths and patch boundaries, not every possible runtime transfer or downstream matching operation. No claim about resale, retention or a particular person's Meta profile follows from them.

Evidence reviewed 28 October 2026. Read identifiers, consent and methodology.