Why Facebook links your accounts to each other: seven signals

A platform does not look for one person behind two names. It collects the small things your browser hands over, then watches for two columns sitting too close.

Seven of those small things are named below. The platform takes the first three itself: the handshake between the apps, the logging inside the page, and the counter on other sites. The other four arrive from your side.

Facebook and Instagram belong to one company and pass a user identifier between themselves directly. The exchange runs on a plain page load, with no click of yours and no login form.

One request leaves Facebook, another comes back from Instagram, and each carries the neighbouring app's identifier. Open both in one profile and you hand them a finished pair of accounts.

1. 1

   You open the page

   Neither a login nor a click is needed for the exchange.

2. 2

   Facebook calls its neighbour

   The address facebook.com/ig_xsite_user_ carries the identifier outward.

3. 3

   Instagram answers in kind

   The address instagram.com/accounts/xuserid names the same person.

Besides that handshake, Meta logs inside the page what you opened, how long you looked, how far you scrolled. Those requests go to the address you came to, so they look nothing like an outside counter.

An ordinary domain blocker lets them through. Only a rule written against the request address closes them, and a profile on the Social media scenario carries those rules.

An address piece like /ajax/bz turns up on other sites too, and cut everywhere it would break unrelated pages. So the social set's rules are locked to the platforms' own addresses: Facebook and Instagram have two names each, their own and their image store, and five more names belong to X and Pinterest.

On somebody else's site the same piece goes through as usual. On its own platform it is cut, and the platform loses a report rather than a page.

The second layer of record keeping lives off the platform. A shop, a blog or a landing page puts the counter there, and it reports your visit before you click anything.

That counter recognises a browser by the same small things, so it pairs your two profiles just as easily. Below is the social counter list that comes with the Social media scenario, laid out by network.

A link from an ad or a chat carries a tail: fbclid, igshid, mibextid and thirty-seven more tags by which the platform learns who sent you and from where. The same tag arriving in two profiles ties them together without any fingerprint.

The profile cuts those tags on navigation, and the page opens the same, only without the tail. A link you copy is not touched: what gets cleaned is where you go, not what you paste into somebody's chat.

A platform compares the exit address first, and that comparison costs it least. Two profiles on one address look like two tabs of one person, however far apart their fingerprints sit.

A datacentre address is known by whoever owns the range, and Meta has known those ranges for years. A home or mobile address costs more, and it does not label your profile in advance.

A page reads your timezone and your browser language list without asking. When a proxy takes you out through Brazil while the clock says Moscow, a platform sees someone hiding.

The zone and the language set have to follow the exit country, not the machine on your desk. In the app they come from a table of 114 countries and land in the profile once the proxy country is known.

Timezone and languages come from the exit country, and the country has to be learned first. The profile asks four independent sources in turn, through its own proxy and only over a secure connection, and takes the first clear answer.

If all four stay silent the country is not invented: the profile opens on the zone it drew at creation, and a warning about it appears on screen. An invented country would be worse than an honest «unknown».

Your browser tells a page the screen size and the window size, and the page reads both in one line. A window wider than the claimed screen describes a machine that does not exist.

Across a pool of 900 profiles a maximised window did not fit the claimed screen for about six profiles in ten, and that figure is for a 1920 by 1080 monitor. On another monitor the share is its own. The pool held 18 distinct screens.

A site asks the browser for the graphics card name and, separately, for the processor architecture. Each answer alone looks ordinary, and together they describe a machine nobody ever built.

That pair used to show up on macOS profiles: the name Apple M1 next to the architecture x86. It is the case our card-against-architecture check was written for, and today it holds them together. A real Mac with that card does not report x86, and one contradiction is enough.

Six of the seven signals are visible from a browser console in one evening, with nothing to install: the network list is that same console. The seventh is the exit address: a browser does not show you its own external address, you ask an outside source for it.

Walk your profiles in pairs: those meant to stay strangers have to differ at least in exit address, clock and screen. A matching pair is the one a platform writes its rule for.

1. 1

   Compare the exit address

   Two profiles meant to stay strangers leave through different addresses.

2. 2

   Compare clock and languages

   The zone and the language set follow the country you exit through.

3. 3

   Compare screen and window

   A window is never wider than the screen a profile claims.

4. 4

   Watch the network list

   The first load shows whether the identifier exchange goes out.