In-App Browser
An in-app browser is a web view built into a mobile app that opens links inside the app instead of handing them to the phone’s default browser. Instagram, Facebook, TikTok, LinkedIn, and Snapchat all use one. It keeps users inside the app, but it also changes what websites can see and what analytics tools can measure.
Types of In-App Browsers
Mobile in-app browsers fall into three groups. The type decides how much the app can see and whether the visit shares data with Safari or Chrome.
| Type | Platform API | Can the app run its own scripts on the page? | Shares cookies with the default browser? |
|---|---|---|---|
| Custom web view | WKWebView (iOS), Android WebView | Yes | No |
| Safari View Controller | SFSafariViewController (iOS 9+) | No | No, since iOS 11 |
| Custom Tabs | Chrome Custom Tabs (Android) | No | Yes, with Chrome |
Most social apps use the first type. A custom web view gives the app full control of the page, including its own toolbar and scripts. Apple’s own guidance points developers to SFSafariViewController for showing arbitrary websites, and to WKWebView only when the app needs to interact with or control the content.
How In-App Browsers Affect Tracking
In-app browser tracking problems come from three behaviors.
- Separate cookie storage. A custom web view has its own cookie jar. A visitor who taps an Instagram link and later returns in Safari gets a new Google Analytics client ID, so one person is counted as two users and the conversion loses its first touch.
- Missing referrer. Many in-app browsers send no referrer, or send a redirect domain such as
l.instagram.com. Untagged clicks then land in Direct or in a vague referral row. This is a large share of dark social traffic. - Early exits. Users often close the in-app browser before the page and tag finish loading. The platform logs a click, but analytics logs no session.
UTM parameters solve the attribution part because they travel in the URL, not in a header or cookie:
https://example.com/spring-sale?utm_source=instagram&utm_medium=social&utm_campaign=spring-sale
They cannot fix the split cookie jar. Cross-browser journeys still need a login, an email capture, or server-side matching to connect.
Privacy Concerns With In-App Browsers
A custom web view can inject JavaScript into any website it opens. Security researcher Felix Krause showed this in August 2022. His tests found that Instagram and Facebook on iOS inject a Meta script (pcm.js) into third-party pages, and that TikTok’s in-app browser subscribes to every tap and keystroke on them.
Meta said pcm.js aggregates conversion events and is needed to respect a user’s App Tracking Transparency choice. TikTok said its code is used only for debugging and performance monitoring. Krause’s tool, inappbrowser.com, lets anyone open the page inside an app and list the JavaScript commands it detects.
Safari View Controller and Custom Tabs do not allow this kind of injection, which is why privacy researchers recommend them for opening third-party sites.
How to Detect and Exit an In-App Browser
Websites detect in-app browsers through the user agent string. Common tokens include:
Instagram(Instagram)FBANorFBAV(Facebook on iOS) andFB_IAB(Facebook on Android)BytedanceWebviewormusical_ly(TikTok)LinkedInApp(LinkedIn)
Detection is useful for showing an “Open in your browser” prompt on checkout or login pages, where a separate cookie jar causes the most friction.
Users can leave most in-app browsers from the three-dot menu, which usually has an option such as “Open in browser”. In Krause’s 2022 tests, TikTok was the only app tested that offered no such option. Facebook has at times offered a setting to open all links externally, but its name and location have changed between app versions.
Common Misconceptions
- “In-app browsers strip UTM parameters.” The in-app browser loads the URL it is given, query string included. When UTMs go missing, the usual causes are a redirect that drops the query string or a link that was never tagged. Test the full redirect chain before blaming the app.
- “An in-app browser is just Safari.” On iOS, every app must use Apple’s WebKit engine, so pages render like Safari. The storage, extensions, saved logins, and privacy settings are not Safari’s.
- “Platform clicks should match analytics sessions.” They rarely do. Early exits alone open a gap between the two numbers.
Frequently Asked Questions
What is an in-app browser?
An in-app browser is a browser window that opens inside a mobile app when you tap a link, instead of switching to Safari or Chrome. Social apps such as Instagram, Facebook, and TikTok use them to keep users in the app. The page loads normally, but cookies, saved logins, and extensions from the default browser are usually not available.
What is the Instagram browser?
The Instagram browser is Instagram’s in-app browser, the window that opens when you tap a link in a bio, Story, ad, or DM. It is a custom web view, so it keeps its own cookies and can run Meta’s scripts on the page. To switch to your default browser, tap the three-dot menu and choose the option to open the page in your browser.
Is an in-app browser safe to use?
An in-app browser is safe for reading, but it is not private from the app that runs it. A custom web view lets the app observe and modify the pages you open. For logins and payments, opening the page in your default browser keeps your saved passwords and the app out of the session.
How do I stop links from opening in an in-app browser?
Most apps do not offer a permanent off switch. Use the three-dot menu on each link to open it in your default browser instead. Facebook has offered a “Links open externally” setting in some versions, though it has not been available in every release.
Why does in-app browser traffic show as direct in Google Analytics?
In-app browsers often send no referrer, so Google Analytics has no source to read and records the visit as (direct) / (none). Adding UTM parameters to every link you share in apps fixes the source attribution. Tagging does not merge the in-app session with later visits in Safari or Chrome.
To tag links before sharing them in social apps, use the free UTM builder at linkutm.