In June 2025, researchers disclosed a localhost-based technique that linked Android web browsing identifiers with native-app identities. Their later paper reports that Meta and Yandex terminated the studied tracking method on June 3, 2025. This article is a historical case study, not evidence that the same method is operating on your website today.
What the researchers demonstrated
The study Bridges to Self: Silent Web-to-App Tracking on Mobile via Localhost describes communication between website scripts and native Android apps through localhost channels. In the studied configurations, those channels could connect pseudonymous web identifiers with persistent app identities and undermine browser privacy boundaries.
The research concerns specific Android applications, scripts and browser behavior. It does not establish that every operating system, website using a pixel or private-browser session was affected in the same way.
Distinguish the historical finding from current behavior
The authors describe responsible disclosure and deployed mitigations, and report the termination date for the studied method. Their research project provides technical context. An older account of a live experiment should not be presented as a current measurement without reproducing it on current versions.
Whether a particular organization's deployment creates legal liability depends on its role, implementation, data and applicable rules. Installing a named product is not by itself evidence that the organization committed an unlawful act.
What a website owner can verify now
- Inventory third-party scripts, tag managers and plugins, with an owner for each.
- Review current vendor documentation and security advisories for the versions deployed.
- Inspect requests and storage in a controlled synthetic session, including relevant collection choices.
- Investigate unexpected localhost or other destinations with the technical and privacy owners.
- Record the observed behavior and affected versions before drawing conclusions.
Evaluate an analytics change on its own evidence
Replacing an advertising pixel with a website analytics service changes the measurement purpose and available reports. It does not automatically replace advertising conversions or resolve every privacy requirement.
Databuddy avoids analytics cookies but uses browser storage and sends events to a collector. Review its collection model and the properties your application sends. Use the privacy review worksheet to document the intended setup, and test a completed synthetic action before enabling collection.