Every time the company sends a push notification to an iPhone, its app can collect information about the user, including their location, according to security researchers. Meta and TikTok reportedly use push notification tracking, and so do many other companies.
Fortunately, there is an easy solution for users to protect their privacy and prevent apps from spying on them.
TikTok and Facebook use push notifications to secretly track users
Social media companies are actually advertising companies and they make more money from their ads if they can target them to users. Therefore, they collect personal data in all possible ways. It turns out that one way is to track push notifications, according to Myska pair of security researchers.
When an iPhone app like Facebook receives a notification—maybe a user got a “like”—there’s a lot more going on than a simple pop-up on the screen. iOS allows closed apps to activate in the background and run to process notifications.
The idea is to allow third-party software to make the notifications displayed on the iPhone more useful. But companies use this feature to collect user data whenever they receive a notification.
As security researchers at Mysk explain:
“Unsurprisingly, many social apps known for their aggressive data collection practices take advantage of the background runtimes enabled by push notifications. In fact, developers can use this workaround to run code in the background on demand. All they need to do is send push notifications to their users. As a result, iOS would wake up their app in the background on each device, and then the app would run whatever code the developer embedded in the app.”
Many apps request tracking of the user’s location, but users can limit this to only while the app is running. But the app that handles the notification is works and thus can record and transmit location data.
It doesn’t stop there. Mysk reports that iPhone apps use push notification tracking to collect “system uptime, locale, keyboard language, available memory, battery status, device model, screen brightness, to name a few. Such signals are commonly used to fingerprint and track users in different applications developed by different developers.”
The practice is apparently widespread. It’s used by TikTok, Facebook, FB Messenger, Instagram, Threads, X and “many more,” according to Mysk. Last December, Apple confirmed that some governments were using push notifications to spy.
How to protect your privacy: Disable notifications
Screenshots: Ed Hardy/Cult of Mac
Fortunately, there’s an easy way to block push notification tracking: simply stop allowing suspicious iPhone apps to send you notifications.
The change is not difficult, but must be done for each application. And security researchers at Mysk say it’s necessary to disable all app-specific notifications — switching to badges or just alert sounds isn’t enough.
To make the change, go to settings and scroll down to Notifications. Find the app you want to disable notifications for and tap it. A page will appear with a whole bunch of notification options, but all you need is the one at the top: Be safe Allow notifications is turned off.
Repeat the process for Facebook, X, etc.
Obviously, protecting your privacy means opting out of receiving alerts whenever someone likes or replies to one of your social media posts. But the change will likely make you more productive… and maybe even happier.
Mysk made a video with more details on tracking push notifications: