Last night you searched for a medication. You went to a pharmacy website, maybe WebMD, maybe a generic drug information page. You weren’t on Facebook. You didn’t share anything. You didn’t click an ad.
Facebook knows you did it anyway.
This is not a hypothetical. It’s how Meta’s tracking infrastructure works, and it operates on roughly one in three websites on the internet. You don’t need a Facebook account for it to apply to you.
The website that told Facebook about your health search
The site you visited had a small piece of JavaScript embedded in its code: the Meta Pixel. When you loaded the page, that script fired silently in your browser and sent a report to Meta’s servers. That report held your IP address, a fingerprint of your browser, and the page you visited. In some cases it also held the specific action you took: searched for a drug name, clicked a product, added something to a cart.
Meta matched that fingerprint to your existing Facebook profile. Now it knows about your health concern — even though you never typed it into Facebook, never shared it with a friend, never clicked a single Facebook ad about it.
This information lives in your advertising profile. It shapes which ads you see. It categorizes you into “interest segments” that Meta sells access to. And it persists long after you’ve forgotten you ever visited that site.
What the Meta Pixel is
The Meta Pixel (formerly Facebook Pixel) is a snippet of JavaScript that website owners paste into their site’s code. It takes about five minutes to install. Meta provides it free of charge because the tracking data it returns is worth far more than any fee they’d charge.
When you load any page with the Pixel installed, several things happen at once. Your IP address is recorded. A tracking cookie is set or read in your browser. Your device fingerprint is logged. And the page you visited is reported to Meta. If you’re logged into Facebook in the same browser, the match to your profile is direct. If you’re not logged in, Meta uses your fingerprint and IP to probabilistically match you to a profile anyway, a technique called cross-device tracking.
Approximately one in three websites globally has the Meta Pixel installed. That includes news sites, healthcare providers, government services, and retailers. The journalism outlet The Markup found in 2022 that Meta Pixel was present on major hospital websites — reporting the specific conditions patients were searching for back to Meta. Several hospitals faced regulatory investigations as a result.
Your Off-Facebook Activity — go look at it now
Meta gives you a tool to see a summary of what it’s collected from third-party sites. It’s called Off-Facebook Activity, and most people who find it are startled by what’s in it.
To find it: open Facebook on desktop, go to Settings & Privacy > Settings > Your Facebook Information > Off-Facebook Activity. What you’ll see is a list of every company or website that sent your activity data to Meta. Not a short list. For most people who’ve had an account for a few years, it runs into the hundreds or thousands of entries.
You can clear this data and disconnect future tracking from your account using the “Clear History” and “Manage Future Activity” options in that same menu. Here’s what “clearing” actually does: it breaks the link between your past off-site activity and your Facebook account profile. It does not delete the underlying data from Meta’s servers. Meta retains it in anonymized form. The data still exists; it just can’t be connected to you by name — at least according to Meta’s own policy documentation.
Still worth doing. But understand what it does and doesn’t accomplish.
Shadow profiles: you don’t need an account
Here’s the part that surprises people who have never signed up for Facebook.
When any of your contacts installs Facebook and grants it access to their phone contacts, your name and phone number upload to Meta’s servers automatically. You never consented. You were never asked. You didn’t agree to any terms of service because you’re not a Facebook user.
Meta uses this data to suggest “People You May Know” connections to new signups, build advertising profiles on non-users, and populate its social graph. Senator Dick Durbin asked Mark Zuckerberg directly about this practice during his 2018 Congressional testimony — specifically, whether Facebook collects data on people who haven’t created an account. Zuckerberg confirmed that it does, describing it as a “security” measure. Critics call it what it is: a shadow profile system that extends Meta’s reach to every person connected to any of its 3 billion users.
If you’ve never had a Facebook account, there is very likely a partial profile of you on Meta’s servers right now, built from contact lists uploaded by people who do.
The 2021 breach: 533 million records
In April 2021, a dataset containing information on 533 million Facebook users appeared publicly on a hacking forum — no purchase required, just download it. The data included full names, phone numbers, email addresses, birthdays, and location data. For many users, home cities and employers were included.
The breach originated from a vulnerability in Facebook’s contact importer feature, which allowed bulk enumeration of user data by phone number. Meta was aware of the vulnerability by 2019. The data was scraped before the vulnerability was patched. Then it sat in private hands for two years before being posted publicly.
Troy Hunt added the dataset to Have I Been Pwned (haveibeenpwned.com). You can check whether your phone number or email address was in it — phone number search is available under the “Phone” field on the HIBP site. A significant percentage of Facebook users globally were included.
The Irish Data Protection Commission fined Meta €265 million for this breach in 2022. A separate €1.2 billion fine followed in 2023 for unlawfully transferring European user data to US servers in violation of GDPR. At €1.2 billion, the 2023 Meta fine was the largest GDPR fine ever issued at the time. The earlier €265 million fine for the 2021 data scraping incident was also among the largest. Meta appealed both.
What you can actually do
Clear your Off-Facebook Activity and set it to not track future off-site activity (the path is: Settings > Your Facebook Information > Off-Facebook Activity > Manage Future Activity). This reduces the amount of cross-site data linked to your account going forward.
Install uBlock Origin in your browser. It blocks the Meta Pixel from loading on third-party sites — meaning the script never fires, the data never reaches Meta. This is the most effective technical control available to you and it works immediately. It also blocks most other third-party trackers. There’s no reason not to run it.
Use a separate browser profile — one where you’re never logged into Facebook — for general browsing. When your Facebook session and your general browsing session are in the same browser profile, Meta can link your off-site activity to your account directly via cookies. A separate profile breaks that linkage. Your regular browsing stays in one profile; Facebook stays in another.
Consider whether Facebook’s actual utility to you justifies the tracking cost. That’s a genuinely personal question. The platform has real value for some people and almost none for others. But it’s worth asking honestly rather than leaving the relationship on autopilot.
The same identifiers Meta collects — your name, phone, and address — also power the people-search brokers. Broker pages like BeenVerified and Spokeo show what those sites hold and how to opt out.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.