Meta unveils Pseudonymized Facebook Identifiers, which combine timestamps and Facebook Identifiers, to make it harder for attackers to scrape unauthorized data
similar to Canary tokens which provide the “canary in the coalmine feature” to alert when there is a problem. The new pFBIDs both protect user privacy BUT ALSO flag advertisers violating the FB terms of service. f'ing brilliant. https://twitter.com/... @ukosint : Facebook changes, really annoying for OSINT people https://twitter.com/... @nixintel : The new PFB IDs are not widely implemented on FB yet but after a bit of testing most techniques seem to work as before. We'll see what else changes as PFB IDs get rolled out... 10/n @unleashedosint : #OSINT #Privacy #FaceBook #Identifier META FINALLY stronger steps to protect users' Identifiers- will help w/ some privacy from data collectors outside META. Some OSINT Techniques will be impacted beyond “scraping”. & a portion of 32,900 Google Indexed Github Urls w/code- RIP https://twitter.com/... https://twitter.com/... @osint_research : Take note 4 #OSINT: if you're tracking account changes using the FB-id, I assume it will no longer work. Deterring Scraping By Protecting Facebook Identifiers #Meta https://about.fb.com/... @samuellavoie : Facebook is cleaning up some of its mess. It's been years using FBID for user's data scraping. https://about.fb.com/... Akvile DeFazio / @akviledefazio : Took a few months for an official statement, but here are the details about Meta's FBID update: Deterring Scraping By Protecting Facebook Identifiers https://about.fb.com/... @privacat : @thezedwards I suppose my skepticism is high because we've all been burned before. Repeatedly. I hope you're right. I hope that this does protect user privacy (assuming they don't leave an API open to fetch the actual FBID or allow for another CA). Fingers crossed. Zach Edwards / @thezedwards : I'm glad that Facebook finally took action to protect userIDs from scraping. It's hard to know if they ever ran an experiment that someone could have suggested which would have caught advertisers using scraped IDs- would be quite the problem for some orgs! https://twitter.com/... @tiberianorder : @OliverKlein A small step for Zuckerberg, a giant leap for boomers who post cat pictures on Facebook. Zach Edwards / @thezedwards : @PrivaCat With all due respect, it does a ton for user privacy + it creates a feedback loop to catch unregistered data brokers. It was *profitable* to scrape Facebook. You grab a userID + scrape their FB likes, and now you've got yourself a custom audience that can be sold and activated. Zach Edwards / @thezedwards : @PrivaCat It literally prevents advertisers from sharing custom audiences that's the #1 , #2, #3, #4, #5 ... etc purposes This fixes a massive exfiltration problem & breaks the business model of dozens of shady orgs. They are bankrupt as of today. Literally. cheers. Zach Edwards / @thezedwards : If you are still creating static IDs (cough *hashed email schemes*) you are at a massive risk for exfiltration of audience data. Do this: “We created Pseudonymized Facebook Identifiers (PFBIDs), which combine timestamps and FBIDs to generate a unique time-rotating identifier. ” https://twitter.com/... @privacat : @thezedwards I mean, I'm a-ok with shitty data brokers going out of business. I'm just glad we're on the same page that this doesn't really do much for user privacy. It just limits the path exploiters can use. Now they need to pay FB. Or, you know, do another data breach. @privacat : @thezedwards The key here is “pseudonymized” FBIDs, which means FB will absolutely be able to match back, and allow advertisers to (via FB) match back users and their behaviors. At best, this stops scraping, which only really cuts into FB's profits. I predict it will do SFA for user privacy. Dutch Osint Guy Nico / @dutch_osintguy : This will be a very interesting things to follow closely. Might have huge impact on #OSINT search capabilities https://twitter.com/... @versvs : Everytime I see these features I think that the asymmetry of information increases. Facebook will still know everything. Yes, random stalkers won't, but FB's distortion due to the asymmetry will persist, if not increase, with this. Peanuts. https://twitter.com/... Dr. Emma L Briant / @emmalbriant : Oh about time... https://twitter.com/... Glenn White / @justicar : How much you wanna bet that this doesn't stop FB from tracking user behavior in the slightest? You know they'll have a complete key, right? The walls get higher and thicker. https://twitter.com/... Dr Augustine Fou / @acfou : huuuuuuuuuuuuuuuuuuge news; great for privacy Deterring Scraping By Protecting Facebook Identifier https://about.fb.com/... Oliver Klein / @oliverklein : Bad news for #OSINT-researchers: #Facebook abolishes unique user-ids - “We created an identifier that combines a timestamp and a FBID to generate a unique time-rotating identifier” https://about.fb.com/...
Context & Ripple Effects
Meta's Pseudonymized Facebook Identifiers fuse timestamps with existing FBIDs, producing time-rotating identifiers modeled on canary tokens — so a misused ID doesn't just fail, it reports back who mishandled it. OSINT researchers tested the change within a day and found most existing techniques still work while rollout is partial.
The move sits at the head of Meta's identity-enforcement arc: the identifier hygiene introduced here is the same layer of account-level signal that later powered the takedown of roughly 10M impersonation and content-reuse profiles, and it precedes the Facebook Verified program that attaches facial-recognition badges to real-human status.
First-order effects
- Scrapers and data brokers holding FBID-keyed profile datasets watch their caches decay as identifiers rotate with timestamps, raising the cost of keeping unauthorized copies fresh.
- Advertisers violating Facebook's terms of service now trip a built-in alarm — the canary-token design turns every identifier into evidence of misuse, not just an access key.
Second-order effects
- OSINT practitioners report techniques working for now but face retooling as PFBIDs roll out widely, pushing open-source investigation away from raw identifier lookups.
- Cleaner identifiers feed Meta's enforcement machinery downstream — the same per-account signal quality that made large-scale impersonation takedowns tractable in later years.
Third-order effects
- If timestamped rotation becomes the norm, the effective permission boundary around 'public' Facebook data shifts from who can fetch a page to whose credentials touched it — a structural move toward trust-as-platform-infrastructure.
- The identifier layer built to deter scrapers also gives Meta a substrate for attaching verification signals like badges and facial-recognition checks, consolidating its control over what counts as a real user.
The trend: Platforms are replacing static public identifiers with rotating, self-reporting ones, turning identity metadata into both a privacy shield and an enforcement sensor.