How to stop Facebook from tracking you

As it turns out, Facebook and it’s advertisers collect your data with or without your consent from regular browsing and mobile app use. Even if you are not a Facebook user! Its time to block Facebook tracking!

I recently deleted my Facebook account and decided to stop them from tracking me and my apps. Here are couple of technical ways for you to get started!

Read the previous article, why I’m doing this

What does Facebook collect?

Facebook Audience Network is a tool used by developers, including 41% of the apps on Google Play Store (1) that gathers personal data:

• Advertising ID
• Device information
• Device identifiers
• GPS locations
• Information about activities within the mobile app
• Your IP-address
• Data the app developer whats to include

If you don’t want Facebook to gather information about you, here is a simple guide how to block them from getting their fingers into your data.

Block Facebook from tracking you

There are many ways to stop Facebook from tracking you. 

Option 1) Ghostery

Ghostery is a solid browser-add on, that monitors what is being loaded when you browse the web. It automatically blocks stuff like Facebook pixels and thus, keeping your data to yourself.

This works usually fine, and is very easy to setup. It also can disable a host of other trackers. If you want to allow some tracking (for example Google, because their ads are not intrusive and in some cases – actually helpful), you can allow these.

You can get Ghostery from Chrome Web Store

Only downside is, that if you want to sync settings between browsers and devices, you need to create a Ghostery account. This means more data you need to risk leaking.

Option 2) Hosts-file

You can use so called “hosts-file” to block your machine’s and apps from sending data to Facebook. This works on most modern devices if you can access the file.

Note: This blocks pretty much all Facebook-related activities on your device. After doing this procedure, you can not use apps like Facebook, Messenger, WhatsApp and Instagram on your device.

If you want to block just Facebook’s analytical features, don’t use the full block-list below, just enter graph.facebook.com in the device’s hosts file.

What is a hosts file?

A hosts-file is a configuration file on computers and phones that maps hostnames to IP addresses.

You can think of it as a phone-book on your computer. Where hostname is the name of your contact, (for example, facebook.com) and IP-address is the phone number. This tells the machine where it should actually contact, because you can’t dial names.

How DNS works

When you open your browser and write henrirantanen.fi and hit enter, your device checks the local hosts-file to see what’s the number.

If the “routing” does not exist, (like usually doesn’t) the device send a DNS-request to the next node in your network, probably your router.

If the router doesn’t know either what the number of this henrirantanen.fi is, it will pass the request on to your Internet Service Provider and process continues. All the way to main DNS-servers, until the number is found.

Where to find hosts-file?

On Windows for example, you can edit the hosts-file by opening notepad as an administrator and opening a file: C:\Windows\System32\drivers\etc\hosts.

This should open a text file (without the .txt file name ending) that contains stuff like your loop-back address 127.0.0.1 defined.

Routing hostnames with hosts-file

For example, if you add a following row to your hosts file and save it:
0.0.0.0 facebook.com

Your device will send all requests made to facebook.com “nowhere“. Thus facebook.com can not be reached and you have blocked all traffic to facebook.com from the device, on an operating-system level.

Block Facebook tracking on desktop

Copy this list of Facebook’s domains, content delivery network addresses and tracker API:s to the end of your hosts-file and save it.

You are done.

List of Facebook’s domains to block

If you can’t save the hosts file, make sure you have opened the editor with administrator’s privileges. If Facebook’s sites seem to still work, the domains might be cached by your browser. Open an incognito window to test it out! Reboot might also be needed.

Domain-list was updated 10/5/2020, there might be newer list available.
Check the source on GitHub. 

Block Facebook tracking on Android

You can use the hosts file on Android to achieve the same result, to stop apps from sending data to Facebook.

Option 1) Non-rooted Android device

If you do not have root-access, you can not edit the hosts-file.

You can still install app, that acts as a local VPN between the device’s operating system and the web. This will emulate the effect of hosts-file and it works fine.

This requires extra processing, and app to be running on the back. I recommend to use this method only, if you can not access root on your device or you are afraid to mess with the phone’s settings. Using this method might have effect on your battery life.

• Download VPN Hosts from Google Play
• Download VPN Hosts from GitHub for you to sideload it

I ended up using this solution, as my current phone, CAT S61 was un-rootable. App is quite simple to use: just install the app, select the hosts file you want, and enable it.

Note: You can always block all of Facebook and disable the hosts-file from the app if you need to access something blocked.

Option 2) Rooted Android device

Here you will edit the actual hosts-file of the operating system. This is way lighter and more sure-fire way for blocking Facebook.

These instructions are for Windows 10 but would work in most Windows-versions. Same process on Linux and MacOS but the magic words are different.

You will need

• Rooted Android phone
• Computer that can run Android studio
• USB cable for your phone
• ~ 1 GB of hard drive space for Android Studio

1) Install Android Debug Bridge

Install newest Android Studio with default options and reboot computer.

• https://developer.android.com/studio

Next, start command line as an administrator and find ADB.exe on your computer.

Set adb location as path with the following command:

Restart command line as administrator.
After this you can access Android Debug Bridge with just command “adb”

2) Turn on developer options on Android device

Turn on developer options on phone
Settings » System » About phone » Click build number 7 times

Enable ADB
Settings » System » Developer options » Turn on USB-debugging

Plug in your phone, and run this on the command line to see, if your phone is connected successfully:

If this is the first time running debugging on the device, popup should appear on device screen asking whether you trust the computer.

Check “always allow” and OK, you might need to re-run the command.
You should see your device connected.

3) Edit the hosts-file on your device

Get the hosts file from your device:

This will download the hosts file from your device and save it on your desktop.

Open the file in notepad or similar, you should see something like this:

This file determines to what IP-adress different hostnames are tied to.

So if you add a row:
0.0.0.0 graph.facebook.com

This means that when apps try to send a hit of data to Facebook’s analytics server, the device routes the data to a non-routable meta-adress designated for invalid, unknown or non applicable target, meaning: its gone.

Take a backup of this hosts file and append the list of domains you want to block. You can copy the full list from above.

Save the file back to desktop and go back to the command line.

This command will read the file from your desktop and write it on the device’s system partition.

You are done!

If this fails because your device is mounted “read only”, run:

Which will remount /system partition on device to writable state. After this running the push command should write the new hosts-file on your device

Congrats, you have edited the hosts-file and you are done.

If it fails, check that you have root access. You can usually root your phone with some tinkering but If your device is un-rootable like mine is, the app method above is unfortunately your only hope.

Sources

1) https://adguard.com/en/blog/one-does-not-simply-delete-facebook/
2) https://www.modmy.com/how-modify-hosts-file-your-android-device
3) https://github.com/jmdugan/blocklists/blob/master/corporations/facebook/all
4) https://www.is.fi/digitoday/tietoturva/art-2000005952613.html