A new report reveals more details on how platforms such as Facebook and Snap bypass Apple’s app tracking transparency feature to collect data. In a recent report, Snap and Facebook used a vulnerability in the feature guide to bypass App Tracking Transparency (ATT). The Information on Friday detailed the quiet workarounds that these social media platforms are using.
More specifically, these companies are exploiting a loophole in the ATT guidelines to continue to collect aggregated user data. This is because the guidelines prohibit tracking users and linking user or device data between different applications and services, but they do not specifically define links.
Therefore, although nearly 80% of iOS systems have opted out of cross-platform tracking, application developers are using this room for maneuver to share data, which can be used to identify users in the future. For example, Snap is using a workaround called “advanced conversion” to receive detailed data about individual iOS user activity from advertising companies.
This data allows Snap to measure advertising efficiency, even if users ask the app not to send this data to Snap. Although these data—including whether users saw the ad and what they did on the app—is encrypted, Snap can still use this to analyze the results and provide advertisers with information about the effectiveness of the ads.
Although this is technically tracking users, Snap does not believe it violates App Tracking Transparency. According to The Information, both Facebook and Google are using similar methods to collect data on iOS users. Facebook did not respond to media requests for comment, and Google said that the way it uses iOS user data complies with Apple’s guidelines.
Apple has previously warned developers and advertisers not to try to bypass ATT, saying that the company must abide by the guidelines for this feature, otherwise it may be evicted from the App Store. Apple said in a statement that its ATT function “has been strongly supported by privacy advocates and regulators. It added, Users’ data belongs to them, and they should decide whether to share their data and with whom.