Another scummy tracking move from Meta, shouldn't be surprised.

In general I think browsers should prevent websites reaching out to localhost without explicit opt-in from the user.