Apple’s big iPhone software updates usually run like clockwork – headline features are added to iOS each autumn when the software is first released. Each subsequent update usually makes minor improvements, such as squashing bugs and fixing newly discovered security flaws. The iOS 14.5 update is different.
The new iOS code introduces Apple’s, much-delayed, new controls on the ways that apps can track people. For the first time, people will have to opt-in to allow apps they’ve downloaded to track their activity.
The changes could potentially upend how the murky online advertising industry works – Facebook is very unhappy about them – but they also give people unprecedented control over how their behaviour is tracked. Apple’s changes, which also apply to iPad OS 14.5 and tvOS 14.5, come at a time when big tech and the advertising industry are facing a day of reckoning over their abuse of personal data.
So what’s changing in iOS 14.5?
The big change you will see is an iPhone or iPad popup that asks you to decide if the app you’re using can track your behaviour across the other apps you use. “Allow ‘Facebook’ to track your activity across other companies’ apps and websites?” reads the example pop-up Apple has shared.
The popup is followed by two options – appearing first: ‘Ask App not to Track’ and then underneath this ‘Allow’. Selecting the first option means apps will not be able to track your behaviour across other apps you’ve installed on your device. This stops data from being shared with advertisers and third-party data brokers.
But what’s really changing?
The big change, which you won’t see, comes under the hood. It’s called App Tracking Transparency and is all to do with a string of numbers known as the identifier for advertisers (IDFA). Each iPhone that’s shipped comes with its own identifier that provides advertisers with aggregate data about your interests.
The IDFA, which was introduced in 2013, is a bit like the third-party cookies that are used in web browsers but work across all apps and services on a device – this is because not all apps use browsers and existing cookies tracking tech won’t work inside them. Google has its own version of the identifier, known as the Google Advertising ID, that’s used on Android phones and was introduced in 2014.
Both these identifiers work in a similar way: they can allow advertisers to track clicks, downloads and purchases within mobile apps. This information can then be used by advertisers and ad technology companies to show you personalised ads in the apps you use. The IDFA can let an advertiser know if the ads they’re paying to put in front of your eyeballs are effective in driving clicks and ultimately sales.
This mobile-level tracking has proven controversial. In November privacy activist and lawyer Max Schrems, who has successfully challenged Facebook’s data sharing in court twice, filed GDPR complaints against Apple’s use of IDFA saying it was put in place without people’s consent. Schrems’ not-for-profit group, noyb, has also filed a data protection complaint against Google’s mobile ad tracker.
While it’s been possible to disable Apple’s identifier for a while – this is done through iOS Settings and then Privacy menus – the iOS 14.5 update turns the process on its head. Now you have to actively opt-in to app tracking, by tapping the ‘Allow’ option, when given the choice.
Apple’s tracking restrictions aren’t just limited to your phone’s identifier. Anticipating apps and developers trying to get around the restrictions and track people in other ways, Apple has said you can’t be tracked using alternative identifiers. A developer can’t use your email address to track your behaviour, for instance. Apple has also changed its policies to say developers can’t hold people to ransom: apps can’t work differently or limit the functions available if you decide to opt-out of tracking.
All apps, including Apple’s, have to ask if you want to share your identifier with other apps and data brokers. Developers are able to add their own messaging to the pop-up that can explain why you might want to be tracked.
However, when you turn off the tracking all advertisers will see is a string of zeros – making sure no data is shared from your iPhone or iPad to the rest of the world. Apple argues the App Tracking Transparency gives you “more informed choices” about the apps you use.
This is a big deal right?
In short, yes. This is the first time that a smartphone operating system manufacturer has turned off ad tracking identifiers by default.
But the move does follow the larger trend of making privacy-enhancing technology the regular choice for users. In the last half-decade end-to-end encryption has become the default option for messaging services such as WhatsApp, Signal and iMessage. And web browsers, including Mozilla’s Firefox and Apple’s Safari, have abandoned the use of third-party cookies – and even Chrome, the world’s biggest browser, is in the process of ditching third-party cookies.
Perhaps unsurprisingly, privacy and civil liberties groups have praised Apple’s plans. Jason Kint, the CEO of trade group Digital Content Next, has called the changes “the most significant improvement in digital privacy in the history of the internet”. (Condé Nast, the publisher of WIRED, is a member of Digital Content Next.)
Apple’s privacy shift has been controversial with advertisers. For one, the advertisers and ad platforms alike are concerned that simply don’t know how many people will give their permission to be tracked across apps. This caused Apple to delay the App Tracking Transparency update, which was originally planned to launch in September 2020 with iOS 14 but was delayed to “give developers time to make necessary changes”. (As it was delayed eight privacy organisations wrote to Tim Cook saying they were “disappointed” about the wait.)
No group or company has been more opposed to Apple’s changes than Facebook – one of the biggest advertising firms in the world. The two companies have repeatedly clashed over privacy and online tracking. This year, the feud has become even more heated. Over the last few months, Facebook has splashed out on full-page newspaper adverts saying the changes will hurt small businesses that rely on Facebook’s ability to track people and show them ads based on their interests. Facebook CEO Mark Zuckerberg has attacked Apple’s plans, saying they are being made in Apple’s “competitive interests”. Facebook was also reportedly preparing an antitrust lawsuit against Apple that referred to its app tracking policies.
Despite the criticism of Apple, Facebook may not suffer too much from the changes. While it will no longer use the Apple identifier across any of its apps, Zuckerberg says it could make even more money. “It’s possible that we may even be in a stronger position if Apple’s changes encourage more businesses to conduct more commerce on our platforms by making it harder for them to use their data in order to find the customers that would want to use their products outside of our platforms,” Zuckerberg said on Clubhouse in March.
Facebook has not been the only critic of the iOS changes. Both LinkedIn and Google say they will stop using IDFA in their apps. Meanwhile the makers of Snapchat and a number of Chinese app developers have been looking at ways to get around the changes entirely. Apple has already banned other apps trying to track people using different techniques.
But overall, there’s still a huge amount of uncertainty about the impact that Apple’s changes will have. Advertisers are expecting the changes will severely limit how many people they can show personalised ads to. There’s very little data to know how much of a dent the changes will actually cause. One survey of apps testing Apple’s opt-in prompt, from ad tech firm AppsFlyer, found 32 per cent of people allowed apps to track them – gaming apps had the lowest opt-in rates while ‘utilities’ apps had the highest.
This article was originally published by WIRED UK
