On Monday, Apple released iOS 14.5, the smartphone update that Facebook fears.
The operating system upgrade includes improvements like a Face ID that’s better attuned to face masks, as well as more convenient interoperability between Siri and various music apps. What’s generating the most discussion, though, is a tool called App Tracking Transparency, which allows users to prevent apps from sharing identifiable personal data with third parties. The tool, billed as a major step forward for user privacy, could roil the digital ads industry, whose major players often track users as they move between apps on their phones. The update should’ve shown up on your iPhone by now; if you weren’t prompted to download it, go to “Software Update” under your general settings. It’s a milestone for the consumer web and a possible blow to social media’s business model, which depends on selling highly personalized advertising. There’s one hitch: Even when you turn it on, you might not notice a single thing has changed.
Whenever you download an app using iOS 14.5, a notification will appear asking whether you want to allow it to “track your activity across other companies’ apps and websites.” You can either select “Ask App Not to Track” or “Allow.” You can also opt in or out of tracking for an app at any time by navigating to the “Privacy” menu in the device’s settings and clicking on “Tracking.” From there you’ll see a list of apps alongside switches you can toggle to turn the tool on or off. Asking an app not to track you means that it isn’t allowed to transmit any of the identifiable location, contact, health, browsing history, or other info that it collected on you with advertisers, data brokers, or anyone else who might be interested in learning more about you. This should prevent, say, Facebook from serving you ads on grills based on the fact that you were searching for them on Chrome. Apps won’t be able to combine data they gather on you with information collected elsewhere by third parties.
It might seem like a fairly unremarkable feature, but App Tracking Transparency has the potential to reorient users’ relationships with their personal data, primarily by making the tracking opt-in. Prior to iOS 14.5, users did have the ability to limit the data that apps shared, but the default was to allow tracking, and you had to proactively check the settings to turn it off. Having the apps themselves ask this question upfront is an important aspect of the shift. “It’s not just giving users the choice,” said Gennie Gebhart, acting activism director of the Electronic Frontier Foundation, the internet-rights advocacy group. “It’s forcing these app developers to ask permission and possibly just stop tracking preemptively so they don’t have this scary permission associated with their app.” There’s a whole industry built around targeting ads using personal data, and if enough people start regularly opting out of tracking, Apple’s new tool could frustrate many of the businesses in this space. Facebook, in particular, is expecting the tool to have a small but noticeable effect on its revenue and has been taking out full-page ads characterizing Apple’s move as hurting small businesses. During the company’s quarterly earnings call in January, Facebook CEO Mark Zuckerberg accused Apple of trying to “use their dominant platform position to interfere with how our apps and other apps work.”
However, if you turn tracking off for everything, will there be any actual differences in how you use your apps or what ads you see? According to Gebhart, it might not be so clear-cut. For instance, if you’re searching for grills on Chrome and then see ads for them on Facebook, that doesn’t necessarily mean that the tool isn’t doing its job. The ad-targeting ecosystem is so complex and multilayered that there are a number of ways that Facebook could determine that you want a grill just from your activity through first-party tracking on its own app. The platform could gather that you’re a middle-aged man who just bought a house in the suburbs at the beginning of the summer and determine that it’s likely that you’re in the market for a grill without ever looking at your Chrome browsing history. In other words, there probably won’t be any noticeable signs indicating that the tool is or isn’t working. You’ll know in theory that apps shouldn’t be swapping your data amongst themselves, but it likely won’t look all that different in practice.
This opacity is partly meant to make the user experience simpler. Being constantly exposed to the under-the-hood mechanics of the apps on your phone could be overwhelming. At the same time, though, keeping all this tracking hidden serves to obscure just how much of your personal info your apps are collecting and sharing. Apple’s new tool adds some more transparency—and thus friction—back into the equation, but there’s still a lot you won’t really be able to see. “There’s so much going on under the surface that advertisers and data brokers don’t want you to see, and all of the sudden Apple is forcing some of that above the surface, but it’s hard to say what to look for to know whether App Tracking Transparency is working,” Gebhart said, adding that users will continue to be at a disadvantage in trying to maintain their privacy online because of this dramatic information asymmetry. Still, one change that could result from Apple’s move is more chicanery from the data-hoovering business, which will need to find more creative ways to build profiles of internet users that can help advertisers target consumers. That’s why Gebhart says she’ll track which apps, if any, Apple decides to kick off its store for violating the tracking rules and any changes in strategy that companies in the digital ads industry are making.
With Apple acting as an unofficial regulator of user privacy, how will companies that want your data cope? It helps to understand how Apple’s update works. The main mechanism for controlling cross-app tracking is to limit access to what’s known as an Identifier for Advertising (or IDFA). The identifier essentially allows apps to combine data they directly collect on certain smartphone users with information collected by third parties elsewhere, like on the web. If you switch App Tracking Transparency off, the app won’t get access to the device’s IDFA. There are, however, loopholes that apps could potentially use try to identify someone without an IDFA. One method, known as fingerprinting, involves using other characteristics of your device like the model and screen resolution to follow you across the web. Under Apple’s policies, though, using this and other unsanctioned tracking methods could lead an app to get kicked off of the App Store. In fact, the company sent warnings in March to developers in China who were trying to create a new way of tracking users with an alternate ID system backed by the country’s advertising association.
“Many of these problems are policy problems,” said Serge Egelman, a research director at the University of California, Berkeley’s International Computer Science Institute, who added that Apple can’t simply relying on technology to mechanistically restrict IDFA access. In order for this new feature to work, it has to make it clear to developers that trying to track people in other ways will result in enforcement actions. “The issue is that the technology would need to anticipate every possible way that information that could be used to identify the user could be transmitted.” Constantly sweeping through apps would likely be necessary to enforce the policy.
Again, a typical user won’t be able to determine whether one of their apps is breaking the rules. It’s really only Apple or highly skilled researchers who could effectively monitor any shady data collection. Egelman noted that even if a typical consumer were able to see the traffic going in and out of an app, it would look like inscrutable strings of numbers and letters. Even someone with some nonspecialized programming knowledge would have a tough time catching everything because some of the information is purposefully hidden. “One of the problems is that there have been a lot of advances in security—good advances aimed at protecting users—that make it a lot harder to intercept the traffic, which at the same time we need to do to see what’s in it,” said Egelman. Most of the time you’d need a special device that monitors app traffic be able to get around those protections. In the end, laypeople will have to depend on apps to follow the rules, on Apple and independent researchers to be on the lookout for rule-breaking, and on Facebook and data-brokers not to get too clever about finding new ways to track us.