limited.facebook.com
Limited.facebook.com is an official Meta domain used mainly for Facebook’s privacy-focused Limited Login system, not a separate social network or a lightweight Facebook homepage.
What is limited.facebook.com?
Limited.facebook.com is a real subdomain of facebook.com that supports authentication for apps using Facebook Limited Login.
Limited Login lets a person enter another app with a Facebook account while limiting how that app and Meta can use the login data.
Meta introduced the system for iOS after Apple added stronger privacy controls around app tracking.
The service uses the OpenID Connect standard, which is a common way for one service to confirm a person’s identity for another service (Meta’s Limited Login overview).
The domain therefore works more like a secure doorway than a normal website.
Why might this domain appear on your screen?
You may see limited.facebook.com after choosing “Continue with Facebook” inside an iPhone or iPad app.
The app can open a browser window, send you through Facebook’s consent screen, and then return you to the app.
This can happen when tracking is disabled or the app selects Limited Login in the Facebook iOS SDK.
Developers have reported that newer SDK versions may switch to Limited Login when a user does not allow tracking, although the exact result depends on the app and its setup (Facebook iOS SDK discussion).
A direct visit to the domain may show a Facebook login page, an error, or a temporary block because the service expects a request from an app.
That does not mean your Facebook account has been restricted.
Facebook uses separate notices when it limits account features because of security concerns or unusual activity (Facebook Help Center).
How is Limited Login different from normal Facebook Login?
Classic Facebook Login normally gives the app an access token.
The app can use that token to request approved information through Facebook’s Graph API.
Limited Login instead returns an authentication token containing an OpenID Connect ID token.
That token can prove who signed in, but it cannot be used to request more information from the Graph API (Meta Limited Login documentation).
This is an important technical limit.
It separates identity checking from broad access to a Facebook account.
The app may still receive basic details that the person approved, such as a name, email address, or profile picture, depending on the current permissions and implementation.
However, developers should not assume that the token works like a normal Facebook access token.
Does Limited Login stop all tracking?
No.
Limited Login reduces one specific type of data use, but it does not make the app or Facebook anonymous.
Meta says the fact that someone used Limited Login should not be used to personalize advertising or measure advertising effectiveness.
The app still learns that the person signed in and may receive approved profile details.
It can also collect information through its own screens, servers, analytics tools, cookies, and privacy rules.
Facebook can process security information needed to run the login session.
Users should therefore read the other app’s privacy notice before approving access.
Limited Login is a smaller pipe for Facebook login data, not a complete privacy shield.
Is limited.facebook.com safe?
The exact domain is legitimate because it ends with facebook.com and sits directly under that registered domain.
The safe form is https://limited.facebook.com/ followed by a slash or a valid Facebook path.
A name such as limited.facebook.com.example.net is not a Facebook domain because its real domain is example.net.
A name such as limited-facebook.com is also different.
Check the full address before entering a password, especially when a link arrives through email, text, or an unknown app.
Use the Facebook app or type facebook.com yourself if the page looks unusual.
You should also keep two-factor authentication enabled and review connected apps through Facebook’s settings.
Facebook provides a Privacy Checkup for reviewing account security, sharing choices, and connected services (Facebook Privacy Checkup).
What should developers know about this domain?
Developers must treat Limited Login as its own authentication flow.
The app’s server should verify the token’s signature, issuer, audience, expiration time, and nonce before creating a user session.
A nonce is a fresh value that helps stop an attacker from replaying an old login response.
NIST defines it as a value with a very small chance of repeating, often created newly for each use (NIST nonce definition).
Developers should also expect less profile data and avoid building core features that require a classic Graph API token.
The strongest design uses Facebook only to confirm identity, stores the smallest amount of personal data, and offers another login method when Limited Login fails.