Privacy International analysed 34 apps on the Android mobile operating system with user bases of between 10 and 500 million.
The charity began the study after the scandal surrounding the now defunct London based political consultancy Cambridge Analytica, which was accused of improperly obtaining personal information on behalf of political clients and using it to influence the outcome of the US 2016 presidential election or the UK Brexit referendum.
Privacy International researchers found that 23 apps sent data to Facebook the moment a user opened them.
Their report, which was presented at Chaos Computer Congress in Leipzig, Germany, stated: "Facebook routinely tracks users, non-users and logged-out users outside its platform through Facebook Business Tools. App developers share data with Facebook through the Facebook Software Development Kit (SDK), a set of software development tools that help developers build apps for a specific operating system."
The apps included language-learning tool Duolingo, job database Indeed and flight search engine Skyscanner – all of which were tested between August and December 2018.
When contacted by Privacy International, Skyscanner said it had updated its data-collecting practices in the wake of the report.
"Since receiving your letter, we released an update to our app as a priority which will stop the transmission of data via the Facebook SDK," the firm told Privacy International.
Facebook told Privacy International that sharing data is "common practice for many companies" and is useful for both users and the companies involved.
"This information is important for helping developers understand how to improve their apps and for helping people receive relevant advertising in a privacy-protective way," Facebook said. "We do this in a transparent manner by explaining the practice through our Data Policy and Cookies Policy, and by using Google's advertising identifier, which can be controlled centrally by people using their device settings."
More about: Facebook