You click a link in Instagram. a browser opens inside the app. when you have your own browser on your phone which has your privacy settings, your ad blockers, some times your privacy extensions. None of that inside these in app browser. These apps can inject JavaScript into every page you visit it can track every tap, click, scroll even form field you type into. security researcher Felix Krause analyzed TikTok's in-app browser and found code capable of logging every keystroke. every tap on a button or image. every text input. including passwords. including credit card numbers. TikTok said it was for debugging. Krause said it's impossible to know for sure. you have to take their word for it. Instagram and Facebook had similar code. Meta said it honored "do not track" preferences using it. what it also did was attribute every purchase you made on an external website back to a specific ad on their platform. you saw an ad. you clicked it. you bought something on a completely different website inside their browser. Meta recorded the conversion. charged the advertiser. and kept the behavioral data. that's why in-app browsers exist. not convenience. attribution. when Apple launched App Tracking Transparency in iOS 14.5, requiring apps to ask permission before tracking you across other companies' apps, Meta said it would cost them $10 billion a year. $10 billion. in-app browsers bypass ATT entirely. the tracking happens inside the app's own context. Apple's permission prompt doesn't fire. Outside in your browser, they can't see what you do. inside theirs, they can see everything.