Meta(data) defense

2026-10-11

How to be less visible to Meta

This guide explains roughly how to stay out of Metas database. It will probably also break half your online experience. But there you go, choose your battles:

Block Meta Domains and CDN:

Configure everything (Browsers, Apps, Devices, ...) to use classic DNS. DoT/DoH circumvent the block.
- DoT uses port 853. Block the port on network level and applications fall back to classic DNS.
- DoH uses port 443 and is indistinguishable from normal HTTPS. It cannot be filtered at the protocol level. It must be disabled per application.
Block the list of Meta domains below in your DNS resolver (Pi-Hole for example), including subdomains.

The primary tracking domains:

connect.facebook.net
pixel.facebook.com
an.facebook.com
graph.facebook.com
graph.instagram.com

The primary service domains:

facebook.com
fbcdn.net
fbcdn.com
fbsbx.com
facebook.net
fb.com
fb.me
tfbnw.net
instagram.com
cdninstagram.com
threads.com
threads.net
messenger.com
m.me
meta.com
meta.ai
oculus.com
oculuscdn.com
fbpigeon.com
whatsapp.net
whatsapp.com
wa.me

Known domains, including CDN edge nodes are in this list (hosts format, less complete than a resolver block):

https://github.com/jmdugan/blocklists/blob/master/corporations/facebook/all

Block Meta at the IP level:

DoH can't be blocked, and hostnames change all the time. However, Meta hands out a sharper knife. If you really want to block the whole company, block the facebook ASNs (AS32934,AS63293) network prefixes in your firewall.

Before you start copy pasting, use this:

A="https://stat.ripe.net/data/announced-prefixes/data.json?resource=AS32934"
B="https://stat.ripe.net/data/announced-prefixes/data.json?resource=AS63293"
curl -s "$A" "$B" | jq -r '.data.prefixes[].prefix'

Grep (-v) ":" to separate IPv4 from IPv6.

Optional DoH IP Block:

If you want to block all known public DoH hosts (not only Meta), here is a list:

https://github.com/jameshas/Public-DoH-Lists/blob/main/lists/doh_ips_plain.txt

A note on DoH

A company that wants to use your data can easily set up its own DoH service, which won't show up in IP lists. Blocking DoH hosts is always incomplete and a witch hunt that cannot be won.

In practical terms, you can try to make good purchasing choices on IoT devices, and you can block HTTPS per host, or only allow HTTPS connections to known good services. Like: Whitelist the update host, Netflix and Amazon Video hosts, and whatever else you need for your smart TV and block everything else.

Browser Configuration:

Use Firefox (or Brave)
Disable DoH

Install uBlock

enable EasyPrivacy and Fanboy's Social Blocking List filters

Add to "My filters":

||connect.facebook.net^
||facebook.com/tr^
||facebook.com/tr/^
||facebook.com/signals/^
||facebook.com/plugins/^
||facebook.com/v*/plugins/^
||an.facebook.com^
||pixel.facebook.com^
$removeparam=fbclid
$removeparam=igshid
$removeparam=igsh

Set in about:config:
- privacy.resistFingerprinting = true # reduces matching surface, breaks some websites (and the dark mode preference), ineffective once you login somewhere
- privacy.fingerprintingProtection = true # alternative to the above, less strict, more compatible

Android Configuration:

Uninstall preinstalled meta services:

  adb shell pm uninstall --user 0 com.facebook.services
  adb shell pm uninstall --user 0 com.facebook.appmanager
  adb shell pm uninstall --user 0 com.facebook.system
  adb shell pm uninstall --user 0 com.facebook.katana
  adb shell pm uninstall --user 0 com.instagram.android

Settings > Privacy > Ads > Delete advertising ID
Android defaults to DoT (Private DNS). Force it to use your DNS block using WireGuard through your home network (where DoT is blocked). This is no defense against DoH.

What happens regardless:

Server-side matching: Conversions API connects businesses. Purchasing Metadata, IP, User Agent, Email, Phone number, Address, Order and purchased Product reaches Meta. Partially hashed are feeding the graph.
Custom Audiences: Advertisers upload customer lists (email, phone, name, postcode).
Contact graphs built by other people: You give your contact data to other people. They add you to their phone book. They give access to their phone book to Meta through one of their apps.
Shadow Profile: Meta APIs/SDK from devices + shadow Pixel, contribution of data from other people, services and businesses.

Worth it?

Honestly? In my opinion: no, not at all cost.

My take on the whole privacy thing:

People go to great lengths to boycott big tech services, while often not knowing what they even collect or do with the data. I believe that's backwards. Big tech is big tech because they're already established. Not using their services has the highest impact for you and your peers, not them. Avoiding them is great effort - technically and socially. And the impact you make? Zero.

What to do instead:

That doesn't mean I like these services and how they operate. But, if every person who currently tries to avoid them, would use their energy in making alternatives better - the world would be a better place.

Example: WhatsApp

Use WhatsApp, but have Signal / Matrix installed. If you connect with someone, ask for Signal / Matrix first, WhatsApp as fallback. No suffering, just promotion and preference.

Configure it privacy friendly (where it doesn't hurt)

Accounts Center: Don't use it when asked.
Settings → Chats → Chat backup: Encrypt it. Otherwise your End to End encrypted chat is saved unencrypted on cloud storage. Or to be precise: It's encrypted, but not End2End encrypted, someone else has the key.
Avoid "Meta AI": It's opt-in when you use it the first time. There's no way to disable it afterwards. Use another AI instead.
Contact List access: That's the difficult one. Without it, WhatsApp is awkward to use. With it, your contacts phone numbers get uploaded. I leave this one up to you. A good way would be to manage your contact list with a 3rd party app, that doesn't integrate with the system contact list. Use the system contacts to store just the information needed for social media with people on social media, and keep everyone else with rich detail in the other app. Btw. if WhatsApp wants to be your default contact or Messages app, just say no.

That's it. Make your choices, choose your battles. The suffering is all yours.