The In-App Switcheroo

Did you know that on your phone, not all links open in your chosen browser? It’s both hard to detect and hard to avoid, and it can completely undermine your choice of a privacy-respecting default browser.

The Hidden In-App Browser

Most of us probably just use the built-in web browser that comes with our phones – Chrome on Android phones and Safari on Apple products. For those of us who are particularly concerned about protecting our privacy, we tweak the browser and system settings to limit the tracking of our web browsing habits, or even install a custom, privacy-focused mobile browser like Brave or Firefox Focus. A few of us even use custom DNS profiles to block ads and tracking, like NextDNS.

But what if none of that mattered? Wouldn’t you be upset to find out that all the effort you expended to have more privacy was basically ignored? Well… be prepared to be upset. In many cases, when you click on links within smartphone apps, all your carefully chosen network settings and your default browser are completely bypassed. Modern smartphone operating systems (Android, iOS) have built-in browser functions that app developers can use – a “web kit” – that allows the app to access and view web content without ever leaving the app. And there’s no indication that this is happening.

There are at least two ways to do this in each OS – one looks like a browser with an address bar, one just looks like more app content. But in both cases, you have not left the digital confines of the running app – and more importantly, you are not using your chosen, default web browser. You are probably also ignoring system-level settings for browser privacy. Things like ad blockers, tracking protections and custom DNS settings can be completely bypassed when using an in-app browser.

Install Our App!!

Ever notice how everyone is pushing really hard for you to download and install their custom smartphone app? You could just go to their web page, right? “No, no, no – you really need our app! It’s better!” This is particularly true of social media and other ad-based companies: Facebook, Twitter/X, Google’s apps (e.g., Gmail), TikTok, Reddit, Instagram, Discord, etc. Just about everyone has an app now, including brick-and-mortar stores – restaurants, grocery stores, and retail stores. In fact, many companies are incentivizing you to use their app with promotions or only offering some functions via their app, even though they could offer them on their website, too.

There can be legitimate design considerations for using a custom, in-app browser. For example, it can be used by messaging or email apps to give you a visual preview of a web link. A company app for employees might allow access to internal-only content or have special security features. Banking apps might have protections against auto-filling credentials or surreptitiously copying account information.

But there are lots of other reasons for apps to use an in-app browser that are purely for their benefit. Forcing you to use an app gives them much more control over you and your experience, and allows them to do a lot more gathering of personal data and track what you do on the web. It allows them to show you ads and track ‘conversions’ (when you click one of their ads and actually buy something). And having an in-app browser lets them keep you from ‘escaping’ their app when you click web links. While your chosen browser might allow you to surf anonymously, their browser knows exactly who you are. It even lets them alter the web pages you see – installing tracking code or inserting their own ads.

Breaking the Chains

So, what can you do about this? Honestly, not much. It’s painful to try to circumvent the in-app browser and in some cases probably isn’t possible. If you have a visible URL (web address), you can try to copy the text of the address and then paste it directly into your browser of choice. You may be able to long-press on the link or button and get a menu option to open the link in your chosen browser or copy the link address. Finally, if you think this link or information would be available by logging into the app-maker’s website, you could try that.

I always avoid installing a dedicated app if I can just go to their website to get the same info or functionality. As a person of a certain age, I tend to prefer my computer to a smartphone, anyway – I like a real keyboard and much larger screen.

But I think this is an opportunity for Google and Apple to give their users more control. There should be an OS setting that forces external web links to open in my default browser and not in the in-app browser. They could offer this globally or per-app or (ideally) both. This would be a great addition to Apple’s Lockdown Mode, where web previews are already blocked in messaging apps. I’d be okay for links to content from the app maker itself to be handled by an in-app browser, though. For example, if the Facebook app wants to show you their privacy policy or a support portal, it’s fine to source that from facebook.com without jumping out to a different browser. And for previews of links, you can use an in-app browser. But for any real web interaction, I should be able to always use my preferred browser.