Adtech vs. iOS, explained

With their last update for the iOS operating system, Apple rolled out a feature called App Transparency Tracking framework.

The requirement for iOS applications to ask for your consent before tracing your activities raised a huge debate on the adtech sphere: privacy advocates unanimously praised Apple move, while the adtech industry vocally opposes it.

But what does this feature introduce? How do you turn it on? And how does it protect users from online tracking?

Yes or No

Mobile operating systems come embedded with a special ads identifier — In Apple case, this goes with the name of “Identifier for Advertisers” (IDFA). It is a piece of information that can be used by iOS applications to uniquely identify your activities and interactions within their App. It also allows these activities to be shared with third parties, and be tracked back to you: in other words, advertisers can combine your interactions with your sudoku app together with those from your newspaper application, as IDFA is telling them that they both have the same point of origin.

Apple now allows you to restrict access to this identifier, and forces iOS apps to ask for your consent, with a clear yes or no option. It also allows you to set no by default via your preferences.

So am I not being tracked now?

If you say no, your activities and interactions within an app cannot be tracked back to you by using IDFA anymore. Also, Apple committed to banning any software that tries to circumvent this limitation with other tracking techniques, such as device fingerprinting.

Apple implementation seems sound, but this is no silver bullet for your privacy. First of all, the GDPR would require Apple to ask for your consent before storing IDFA on your device. What Apple does instead is to install IDFA in the first place, and then allow you to restrict access from third parties.

Furthermore, the surveillance infrastructure we described before still exists, and is still watching you: if you are logging into an app or service with your Facebook or Google accounts, likely, those services will still be able to track you. The same applies to your browsing activities: Apple includes in their browsers’ engine a feature called Intelligent Tracking Prevention, which makes it more difficult for third-party cookies to track you online, but “more difficult” doesn’t mean impossible. Also, trackers are embedded in the email messages you receive, something that still lacks any meaningful protection. Finally, websites will keep tracking you, and so will Google Chrome, Gmail, Facebook and many of the services you are probably using.

Is it anticompetitive?

In the confused screaming that followed Apple’s move, many adtech representatives bashed this move as anticompetitive. These accusations seem conveniently framed and somewhat overstated and, indeed, were rejected by the French antitrust authority.

Indeed, tracking users without their consent is unlawful in the first place, and adtech companies shouldn’t be doing this regardless of any competition issues. Also, iOS apps would still be allowed to show adverts, which could be targeted for instance by using context — for instance, if you downloaded an app to learn French, this app could show you some discounted Ryanair tickets for Paris without “tracking you”. What the new Apple feature does, however, is to impose conditions and limits to how adtech companies can track your activities: they will still be allowed to track you if you say yes, but the adtech industry carefully avoids to elaborate why do they think that at least 80% of iOS users will say a big fat NO to their request.

How can I protect my privacy?

Knowing that Apple is no silver bullets against online tracking, there are some further steps you can take to protect yourself from online tracking. These include:

• uninstalling Google Chrome, and use literally any other browser in the market;
• log in to Internet services with your own email, as opposed to Google or Facebook logins;
• look for guidance on the Internet on how you can further protect from online tracking.

None of these options, however, will fix the adtech industry, that has grown toxic and needs reform: the silver bullet against online tracking is systemic change. Open Rights Group is at the forefront of this battle and:

• if you are from the UK, you can support our fundraiser to take the ICO to enforce GDPR against the adtech industry;
• if you are from the EU, you can join our campaign and ask your MEPs to #StopStalkerAds