Instagram adds controls to limit off-platform data use for ads and AI personalization

Instagram’s new controls target a specific slice of data: activity generated outside Meta’s platforms. The ‘Activity from other businesses’ setting replaces older ad-partner controls, letting users block businesses from sharing their interactions (e.g., website visits, purchases) for ad and AI personalization. This does not stop Meta from collecting or using in-app data, searches, likes, or follows, or device/network signals like IP addresses. The change primarily affects third-party data flows, not Meta’s first-party tracking.

The settings are fragmented by region and platform. In the EU, users can choose ‘less-personalized ads,’ which reduces but does not eliminate signals like location or device info. On iOS, Apple’s ‘Ask App Not to Track’ blocks cross-app tracking but leaves in-app activity untouched. Android users must manually revoke permissions (e.g., location, contacts) to limit data access. These inconsistencies mean engineers must handle varying signal availability across jurisdictions and operating systems, complicating ad-targeting and recommendation models.

Meta’s AI personalization lacks a dedicated opt-out. Since late 2025, interactions with Meta AI (e.g., chat conversations) have been used to tailor content and ads. While users can delete chat history, there’s no setting to exclude these interactions from influencing recommendations. This creates a gap in user control, as in-app activity, including AI chats, remains a persistent data source. Engineers should note that AI-driven personalization relies on a mix of first-party data and external signals, with the latter now subject to user restrictions.

The changes reflect a broader shift toward granular user controls, mirroring regulatory pressures and platform responses. For engineers, this means designing systems that can adapt to partial data availability. For example, ad campaigns relying on off-platform signals may see reduced performance if users opt out, while recommendation engines must fall back to in-app signals. The 90-day delay for contact data deletion also introduces latency in data hygiene processes, requiring asynchronous handling in backend systems.