Over the years, Apple has paid great attention to the protection of user privacy. But in 2020, a decision to limit ad tracking of iPhone users sparked heated debate within the company. At issue is the extent to which this privacy change could upend the digital advertising industry.
Software chief Craig Federighi, who runs a team of privacy-focused engineers, wants to cut Apple’s authority over tools that unscrupulous ad companies, mobile developers and data peddlers use to track iPhone users, according to people familiar with the matter.
On the other side of the argument is a group led by services and advertising chief Eddy Cue and top marketing executive Philip Schiller, who advocate more cautious behavior because many developers rely on it to monetize ads, and Apple’s own App Store revenue may suffer. influence. Although Schiller himself agrees with Federighi and his team.
In the end, the two sides reached a solution. App developers must ask users in advance if they agree to have their online activities tracked on other websites and apps. If users refuse, developers can no longer use the tool to track user data behavior, but use another system developed by Apple to better protect user privacy.
For many digital advertising companies, the impact of the changes Apple began implementing last April has been dramatic, with Facebook parent company Meta Platforms expected to lose $10 billion in revenue in 2022 due to the impact of data collection.
Meta was not the main target of Apple’s change, according to people familiar with the matter. Although some of Cook’s remarks have long been seen as criticizing some of the company’s practices. Instead, Apple is targeting those who misuse user data. For example, some weather apps sell user location data.
Apple executives gradually realized that Apple had created a monster with data-tracking tools that became the backbone of the advertising and surveillance industries. Therefore, they had to make changes.
“Before they opened the legendary Pandora’s box.” Gartner’s advertising technology analyst Eric Schmitt said.
At the heart of that effort is Erik Neuenschwander, an influential Apple veteran who spent 15 years running the privacy engineering team. Neuenschwander came up with the idea for the now controversial tracking tool a decade ago, which has been described as an “eyeball” for advertisers, according to people familiar with the team’s development.
Neuenschwander allegedly originally envisioned IDFA (ID For Ad) as a way to improve user privacy by giving users the option to turn off tracking while also offering what Apple considers innocuous tools to push targeted ads.
But as the advertising industry has grown, he and his privacy team have grown increasingly concerned that ad behavior is starting to become too aggressive. As companies connect user data to databases through apps and services, IDFA is being abused by a copycat industry of intermediaries that track and monitor people around the world, including their location.
According to his colleagues, Neuenschwander is now a vehement opponent of these tracking and surveillance practices and believes the only surefire way to prevent violations of user privacy is for Apple to minimize user data collection in the first place. Last year, when he introduced his team to the rest of the company, he showed a slide that said nothing more than “Disempower Apple.”
Apple’s privacy policy change, an update to the iPhone operating system that went into effect last April, could have ramifications across the tech industry for years to come. According to Flurry Analytics, as of January 2022, on average only 26% of global users allow their online activity to be tracked.
While Meta may be the biggest victim of this privacy policy change, there are not a few companies affected. Advertising tech firm Lotame estimates that in the second half of 2021, Twitter and YouTube will see a 7% drop in revenue as a result, and Snap 13%.
In January, Google followed in Apple’s footsteps by announcing plans for changes to its Android system’s app tracking changes.
Brian Bowman, CEO of mobile app advertising company ConsumerAcquisition, is deeply hurt by changes to Apple’s privacy policy. Bowman, whose company manages $3.5 billion in ad spend for clients, said his clients’ revenue fell an average of 30 percent in the third quarter compared to the second, due to the launch of AT&T (App Tracking Transparency). He believes that Apple should consult more closely with the advertising industry before implementing ATT.
“Apple made its App Market an advertising powerhouse, but they took away the ability to make ads work,” Bowman said. “These guys didn’t act like a partner.” By contrast, he said, Google Delayed changes to its own user privacy policy for two years and is in an open dialogue with the advertising industry for feedback.
“We believe privacy is a fundamental human right, so we design every product and feature with privacy in mind,” an Apple spokesperson said in a statement. “Our team updates our privacy policy as we design our products,” Provide users with better service. AT&T is one example of this.”
Unethical Developer
In 2011, when Neuenschwander took over the product security team, Apple was in the midst of a “location gate” scandal, which revealed that users’ location data was stored in an unencrypted file on the iPhone. When Neuenschwander took over, the company tasked his team with reviewing internal requests for user data and providing early input on privacy features developed by other parts of the company to ensure they meet Apple’s guidelines.
At the time, iPhone hardware had unique identifiers embedded in it that advertisers could use to track user’s movements on the device. But hardware codes have a big flaw in that they cannot be changed or turned off. If people sell or give away their iPhones, advertisers have no way of knowing that different people are using them.
As an alternative, Neuenschwander’s team came up with IDFA, a software identifier of 32 random letters and numbers that resets when a user sells or gives away a phone, meaning the new owner’s data doesn’t will be mixed with the old owner’s data in the advertiser’s database. Additionally, they’ve added a privacy-friendly feature that allows users to turn off the software recognizer in the menu bar.
While this option worries some advertisers, it hasn’t really hit the industry because the IDFA switch is buried under multiple iPhone menus. In the first few years of Apple’s introduction of IDFA, less than 10 percent of users opted to turn off the feature to limit ad tracking, according to three people familiar with the situation.
After that, the ad industry started to use IDFA more than the Neuenschwander team had envisioned, and they built an entire tracking ecosystem around it. Unscrupulous developers use it to collect users’ location data and sell that information to data traffickers for additional revenue.
At the same time, Apple’s privacy engineering team realized that some developers did not respect users’ wishes to turn off IDFA, which is against Apple’s policy and is difficult to detect.
In 2014, Neuenschwander’s team added new regulations on the use of IDFA to prevent this behavior. But they didn’t make any technical changes to force developers to abide by these rules, which many developers ignored.
Around 2016, Neuenschwander’s team went a step further by making it impossible for developers to ignore Do Not Track requests from iPhone users. Once a user disables IDFA, a string of zeros replaces the identifier so developers can’t see it, but they eventually find workarounds and continue to master users’ usage habits.
Around this time, Neuenschwander began privately telling colleagues that he regretted establishing IDFA, in part because other companies such as Google adopted similar identifiers a year later, according to Neuenschwander’s colleagues. The growing prevalence of this practice has plagued Neuenschwander, who majored in symbolic systems at Stanford, an academic program that combines computer science with philosophy, linguistics and psychology.
To what extent does it prevent tracking?
Cook has also begun to criticize data collection as Apple’s privacy team plays cat-and-mouse with developers.
In 2015, he publicly declared that privacy was a “basic human right” and that Apple did not believe in monetizing user data in exchange for free services. In 2018, as Facebook was mired in the Cambridge Analytica scandal, Cook was asked in an interview what he would do if he were in the situation of Meta (then called Facebook) CEO Mark Zuckerberg. Cook replied that he would not be in Zuckerberg’s situation.
“If we monetize our customers as a product, we can really make a lot of money,” Cook said, “but we’ve chosen not to.”
Still, some privacy advocates want Apple to do more to ban aggressive user tracking using IDFA. In 2019, the Mozilla Foundation, a nonprofit technology advocacy group, launched a campaign requiring Apple to automatically reset users’ IDFAs every month, making it harder to build long-term user profiles. (Apple’s engineers don’t think Mozilla’s solution will solve the problem, because developers can connect the old IDFA with the new IDFA).
That same year, Federighi finally got Neuenschwander and his privacy team, which is part of the software engineering department headed by Federighi, to make some changes to IDFA. Federighi agreed to allocate resources for the project and set it up as a “tent pole” (Apple’s internal slang term for a feature that its executives can showcase at its new product launches), according to people familiar with the matter.
Before Apple can publicly release this privacy policy change, however, the three senior vice presidents, Federighi, Cue and Schiller, must agree on how much the feature will prevent tracking and how Apple can mitigate the expected impact of the changes on developers.
In a series of conferences in the fall of 2019, Schiller and his team discussed the potentially severe impact IDFA restrictions could have on App Store revenue. Schiller was Apple’s marketing chief at the time, overseeing the App Store.
While Apple doesn’t take a cut of developers’ ad revenue on the iPhone, it indirectly benefits from the ad ecosystem. Because mobile ads that appear in apps drive downloads of other apps, some of which are paid, Apple takes a cut of those transactions. If the new restrictions on IDFA cause users to see fewer ads, there will also be fewer downloads of apps in the App Store, which is a concern for Schiller’s team, the people said.
The Schiller team is also concerned that the IDFA changes could prompt developers and advertisers to shift their attention and spending to Android apps, so they can more accurately measure the effectiveness of ad spending, it was revealed.
At the same time, Cue’s team is also concerned about going too far in preventing tracking. He runs Apple’s own iAd advertising system, which runs search ads on the App Store and displays ads on Apple News. As such, Cue’s team is particularly sensitive to the consequences of removing the IDFA.
The cue was also a big part of the discussions, as his team is responsible for the development of an existing analytics tool called SKAdnetwork, which Apple intends to promote as an IDFA replacement to measure the effectiveness of ads. Since Apple released the tool in 2018, most developers have shunned it because while the tool is effective at protecting user privacy, they don’t have access to the same granular data as IDFA.
Developer’s desire to survive
Three executives finally settled on a plan: iPhone users can choose whether to be tracked by the app, according to people familiar with the matter. They felt it would be more persuasive if developers and advertisers fought back.
In the fall of 2019, four people from Federighi’s division oversaw the project, with about nine months to execute in time for Apple’s Worldwide Developers Conference 2020, which usually takes place in June and showcases new software features.
Not only do they have to make sure it’s technically feasible, but they also have to coordinate with Apple’s lawyers and be cautious about decisions that could draw the attention of regulators.
For example, they discussed the precise wording of ATT tracking prompts so that it doesn’t feel like they’re pushing users in one direction or the other. They even went to great lengths to define the term “tracking” in the developer rules, narrowly defining it as: linking user data collected from a developer’s app with user data in another company’s app or service.
That means developers, including Apple, can continue to collect user data to improve their own services, as long as they don’t share that data with other parties. Advertisers and Apple’s rivals have criticized the nuance because it gives developers with vast networks of apps and services a distinct advantage, including Apple’s own advertising business.
In order to appease affected developers and advertisers, Apple has decided to make improvements to SKAdnetwork so that advertisers will not be completely ignorant of the effectiveness of their ads. At first, Cue’s team didn’t want to spend resources on improving the tool, as it was rarely used in the past, but has since made some improvements. Of course, this cannot be compared to IDFA.
“SKAdnetwork is a joke,” said Bowman, CEO of App Advertising. “It’s not fully functional, and Apple didn’t invest in building a functional advertising system.”
At its June 2020 developer conference, Apple successfully unveiled ATT and promised to release the technology in the next version of iOS, which usually comes with the latest iPhones in September. During this time, representatives from Facebook, Google and other companies began meeting regularly with Apple to better understand the changes and their impact. Philipp Schindler, Google’s chief business officer, is one of the senior technical executives who meets regularly with Cue to discuss the impact of Apple’s privacy changes, according to people familiar with the matter.
Ultimately, Apple made some changes to SKAdnetwork to please Meta and Google, the biggest players in online advertising. For example, methods were added to measure whether consumers actually clicked on an ad and made a purchase. But the company has rejected other requests it believes would undermine user privacy, according to people familiar with the matter.
Just weeks before Apple was due to release ATT in September, it told developers that it would delay the implementation of ATT. According to people familiar with the matter, it was because a large number of developers opposed and persuaded Apple to delay the release of the feature, they needed more time to adjust and learn how to use SKAdnetwork.
Meanwhile, Neuenschwander’s privacy team realized that Apple’s changes wouldn’t completely eliminate tracking. Developers can still use other methods to identify users, although Apple has long banned these technologies. For example, in the months following Apple’s announcement of ATT, several Chinese tech giants, including Baidu, Tencent and ByteDance, joined forces to build a system that would allow them to continue tracking users across apps.
In response, Apple banned updates to several Chinese apps that tried to use the tracking feature, causing the project to crash.
Apple has also started rejecting apps that use third-party tools that violate its new guidelines, such as those from Adjust, a mobile marketing company that helps developers measure ad performance with other tracking methods.
In December 2020, Facebook ran a full-page ad in the newspaper, escalating its opposition to Apple’s privacy policy changes, saying it was a platform for small and micro businesses because the lack of access to advertising data would be detrimental to them. A day later, Cook said on Twitter that Facebook could continue to track user behavior on other apps and websites, but it would need to ask users for permission in the future. “We believe that users should have choices about their data and how it is used.”
Of course, Cook did not acknowledge Apple’s own role in privacy abuses. Former Apple engineer Johnny Lin believes that Apple made a mistake in incorporating IDFA into the iPhone operating system years ago, and he is glad that Apple finally corrected the mistake. Lin is now the co-founder of the online tracking-blocking app Lockdown Privacy.
“Why did it exist in the first place?” Lin said. “I think with ATT, we’re pretty much neutral on this now. This should become the norm.”