Crowd in Apple store showing end of user tracking without full privacy consent

Apple May Soon Remove Apps Conducting End User Tracking Without Full Privacy Consent

Originally scheduled to debut with the launch of iOS 14, Apple’s mandatory privacy consent requirements are expected to roll out sometime in early 2021. The advertising industry was given something of a stay of execution, but revenue derived from user tracking is expected to take a major hit once the App Tracking Transparency (ATT) framework is fully implemented.

Craig Federighi, Apple’s senior vice president of software engineering, has made clear that developers will not be able to ignore or work around these new terms; their apps will be removed from the app store if they do not comply.

Is third-party user tracking finished on Apple devices?

Apple’s new privacy consent framework has two major components. The first, mandatory privacy “nutrition labels” that are displayed prior to app download, was just recently implemented. Developers must provide Apple with accurate information for these labels, which give a general at-a-glance idea of how the app tracks user data across apps and websites owned by other companies and what personal information it is potentially linked to.

While app developers and publishers are not particularly enthused about the privacy labels, it’s the second and upcoming development that really has them worried. Sometime early next year, Apple will start requiring app developers to display a mandatory privacy consent notice that allows users to opt out of use of the unique device ID to track them. This is the central mechanism by which targeted and personalized advertising works on Apple devices; the presumption is that most users will opt out when given the choice, which means that most of the advertising market will dry up overnight. Device users must still be able to use the app even if they opt out of user tracking.

There are some exceptions in which user tracking can be decoupled from the required privacy consent notice, but they are too thin for most of the advertising industry to make use of without falling afoul of Apple’s terms. App developers are allowed to conduct user tracking without notice if the data collected is not sent off the device in a way that can identify the user, which again defeats the purpose of the personalized advertising infrastructure, or if it is used solely for security purposes that protect the end user (e.g. a bank using identifying information to prevent a user’s account from being fraudulently accessed).

Without affirmative privacy consent from the end user, the app will continue to function but will return the user’s device ID as a string of zeroes. Apple has explicitly banned the implementation of other “workaround” forms of user tracking and identification such as hashed email addresses, phone numbers, and various means of device fingerprinting. Advertisers and tech companies are allowed to display a page explaining why permission to track is being sought before the privacy consent notification pops up, but they are forbidden from attempting to incentivize the user into agreement with things like bonuses or discounts. Attempting any of these things could end with the app being banned from the App Store, which means exile from Apple’s ecosystem. Given that Apple is estimated to have about 30% of the global mobile phone market and closer to 50% in certain countries (such as the United States), and that Apple device users have been estimated to be 2x more valuable in terms of ad revenue, that risk is likely going to be too great for app developers to take.

Are privacy consent requirements the future for all devices?

Apple’s privacy consent moves will certainly limit third-party user tracking on the company’s devices, but the notification requirements do not apply to Apple’s own internal tracking. The cynical view of all of this would be that Apple is doing this not so much in the interest of the end user but to provide a major competitive boost to Apple Search Ads, which was launched in 2016 and has slowly but steadily increased as a source of revenue for the company. That is entirely speculation, of course, but questions of that nature have already led to multiple ongoing antitrust probes for Apple in both the EU and US. Apple also faces legal scrutiny from European data protection authorities for its use of its device IDs for user tracking without meeting standards of proper knowledge or consent.

Regardless of Apple’s plans for its own advertising services, the company’s business strategy is distinct from chief rival Google. It relies on moving premium hardware based on a perceived smooth and secure end user experience, while Google takes more of a “quantity over quality” approach in the licensing of its operating system, Android ecosystem and approval of apps for its own store to keep prices down. While Google has made some tentative moves to limit third-party ad tracking, such as eliminating tracking cookies from Chrome, it likely cannot afford to do something like this while it leans on the ad ecosystem as such a central revenue source. Social media platforms, most notably Facebook, have also expressed strong opposition to the move.

In spite of this, Luke Taylor (COO & Founder at TrafficGuard) believes that the big tech companies will collectively reign in third-party ad tracking through app store review guidelines to the point that government regulation will not even be needed: “A year ago, a privacy prediction might have been more focused on regulation. Today, we are seeing the tech giants taking the lead on privacy… Once these measures are in place, regulation can almost stand down completely because the tech will make it near impossible to violate related regulations. The days of targeting users for advertising based on their behaviour and information shared across sites are numbered – this is another nail in that coffin. This will impact the effectiveness of programmatic advertising, it will also impact the sharing of data from publishers to Google and Facebook within their advertising networks.”

Apple has explicitly banned the implementation of other ‘workaround’ forms of #usertracking and identification such as device fingerprinting. #privacy #respectdataClick to Tweet

Will free ad-supported apps still be viable?

iOS app developers and advertisers are still largely unsure of how to handle Apple’s new privacy consent requirements, due in no small part to the company giving them unclear information about tracking users and data collected from apps (up to and including still not having a firm date for the 2021 changeover). Companies have largely been in “wait and see” mode to date, but the new clarification that bans all forms of device fingerprinting and puts app suspension on the table as a punishment may result in the mass exodus of free ad-supported apps from the company’s app store.