Apple hits back at European activist complaints against tracking tool
reuters.com
reuters.com
What is it there for then?
If Apple doesn't access the IDFA, but provide the mechanism to do so for others, then clearly Apple is still violating the law.
Apple put the IDFA there. Others accessing it is similar to one website giving you a cookie without consent and other websites looking at that cookie. It's still a violation by the website that gave you the cookie without obtaining your consent.
https://developer.apple.com/app-store/user-privacy-and-data-...
There’s a fair bit of documentation about IDFAs (disclaimer: I have never used them, so my experience is limited). Do a search for “IDFA”.
[NB Mainly because I do a lot browsing from my Apple devices - not because I want to use it!]
Think it through: you read this very article, and many cookies on that page you will have consented to will let many ad-tech companies know that you should probably be labeled "privacy conscious". Which, as any good AI will teach them, is closely related to the "extremist left" and "anti fascist" labels. Next, you start Youtube or Insta on your Apple device. Now you suddenly see promoted content from those bubbles because you probably want to click on it.
Ad-tech is dangerous.
Apple is severely limiting IDFA in the new iOS and shows a popup asking whether you want to allow apps to track you. So that's become opt-in.
https://mobiledevmemo.com/mobile-advertising-without-the-idf...
I’d argue that a ruling from the EU aids Apple in moving in a direction they already want to go.
What I’m sure Apple is opposed to is the implication that they are somehow violating GDPR themselves.
"I’d rather be a hypocrite than the same person forever."
The only way to get better is to change the things you did incorrectly in the past.
This doesn't mean it was illegal (or even unethical). Fifteen years ago few people anticipated the privacy implications of smartphones and many people didn't anticipate exactly how much this stuff would be abused. But in order to get better, they need to change their policy.
It's strange too that you go back to 2005, what with the iphone was out only by 2007 and the IDFA launched in 2013. Incidentally, IDFA was create as a way to limit the methods advertisers could use to track users, even as it expanded the pool of users tracked. And in 2013 the idea that digital tracking, as supplied by for example apple, could be bad was certainly not groundbreaking.
I'd disagree with that. It's like blaming the browser for storing the cookie which Facebook uses to track users across websites.
If Apple would use the IDFA in their own products, then it would be a different story.
IDFA's only purpose is tracking. I can't see any legitimate use for it. In this case Apple intentionally created a feature (which most people aren't even aware of) that only has malicious use-cases.
It is for tracking, but not all tracking is malicious. It is used for things like attributing an ad impression to an app install, to measure how effective an ad campaign is at getting people to install an app. This information doesn't really tell you anything about individual users, but is still useful when aggregated.
Although the overwhelming majority of people distrust tracking, a significant minority >20% do not. Every time the discussion comes up here we see people who say they like targeted advertising.
Apple wants to exclude other mechanisms and have an opt-in mechanism to support this 20%. They are one step away from making it opt-in but were delayed by political pressure from Facebook.
If Ad Tracking companies improve their practices, perhaps they can persuade more people to opt-in.
Apple has reached this point by slowly eliminating other sources of fingerprinting from their apis, and adding rules insisting that IDFA be the only identifier used.
The only issue here is that IDFA is not yet opt-in. Otherwise, Apple is way ahead of the game. All other platforms allow some kind of fingerprinting.
So in order for it to work you'd need to also be the developer (vendor) of the initial app which displays the advertisement for your second ad? Otherwise how would it work if let's say your ad is displayed in app from vendor A (and they get their own IDFA), now when your (vendor B) app is installed you see a different IDFA. How would you associate the two?
> This information doesn't really tell you anything about individual users
Except when you correlate it with other information that does identify individual users and suddenly you've deanonymized this "anonymous" ID.
Scum like Facebook, Google, data brokers and advertising companies base their entire business on this and that needs to stop.
If I understand correctly The IFDA is an identifier created by apple, which they let third parties access. The phone is not a channel, it is the creator of the ID so you're analogy doesn't hold.
And come on, the name of this is proof enough that the only use for this ID is tracking users.
Cookies are used to store anything, not necessarily specific for tracking.
Edit: Let me bring an analogy (GDPR applies to physical world too). Most cars have a visible VIN number like a phone has an IMEI (if you replace IDFA with IMEI mentally, which would be much worse if that was exposed to the apps). If you take a photo of the VIN and then track the car using this identifier in some way, you are [potentially] violating GDPR, not the car manufacturer.
> The consent MUST be received before storing cookies
I don't think we have any disagreement about that. We are discussing who is liable for failing to follow GDPR here.
For what it's worth, I have been involved with implementing the GDPR properly in a number of reasonably large companies. Sadly a number of people can say this and a vanishingly small amount of companies actually adhere to it properly, so I'd take it with a grain of salt.
Some people here seem to think it is available in the browser. Using the word ‘cookie’ furthers that false belief.
I otherwise agree with you.
A couple of years ago I realized that Spotify's recommendation algorithm provides me with a better selection of music than any other method ever has.
Lately I've found ads targeted using advanced ML implementation have been of great value to me as well.
I don't remember ever purchasing products from direct response marketing before, but this year I've purchased multiple high importance things that I would not otherwise been even aware of.
>convincing you that you needed a product that you actually didn't
What if it's convincing him that he needs a product that is actually of benefit to him, that he didn't know existed?
I don't want crap pushed on me without consent. Once you have consent, (which is me doing a pull of what you're offering), then it's okay.
I'm surprised with all the controversy over consent in the last year or so that Tech and Ad companies still don't understand this. Then again, the wisdom of Upton Sinclair applies.
--It is difficult to get someone to understand what their paycheck is dependent on them not understanding
>The user on the other hand gets no benefits, the society gets no benefits, and those who benefit are random people whose motives are unclear.
This is blatantly false. In this thread alone there are multiple people who have stated they find benefit through targeted ads.
Several years ago I saw a Facebook ad for an online coaching program for aspiring music producers.
It was exactly what I needed at the time, but I had no idea that someone had put something like this together, and I would never have independently thought of googling this. Instead, I relied on music production tutorials on the one hand, and generic productivity advice on the other hand, and assumed that was the best help available out there.
That is just my anecdote, but I'm sure everyone here has their "how could I possibly live without this before" product or service.
Advertising can be useful, and the more targeted, the less obnoxious.
Personalized recommendations by an app based on your usage of that app are not what people mean by "targeted advertising." The privacy implications are completely different.
I looked it up after writing the last paragraph, and indeed "playlists are [...] based on the country you live in, genres you listen to and your age" (https://www.billboard.com/articles/columns/pop/9456319/spoti...).
Still I'm not sure if this information comes from tracking or my mistake of signing up to Spotify with my Facebook account.
Then by all means, in the future, opt-in whenever you need to!
Your only foundation for this reasoning is that you've bought more things. What this definitely says is that the advertising is targeting you successfully, what it does not say is that you benefited from it. You clearly lived before you owned those things, presumably pretty well given your evident spending habits.
In conclusion, when looking at this post we can say just as easily that you were harmed greatly by targeted advertising.
What like 0.00001% of users would do. That option is useless in practice.
Prior to IDFA, advertisers used other unique on-device information (I believe they had access to the IMEA which was not changeable). With IDFA, users have the option of opting out or at one point resetting the IDFA on the device.
IDFA was fundamentally put in to give uses more control. It wasn't really enough, but it was an improvement over what was before it. Now Apple is improving it again by making it opt-in instead of opt-out.
He's pursuing Apple under German law, and Apple's statement was that they fully follow EU law. So they may both be right at the same time.
In detail, Apple is creating a device-unique ID for advertisement tracking and access to that will be user-controlled in iOS 14. And Schrems is filing because it is exposed to advertisers without the user's consent in iOS 13 and earlier.
default passwords, that can be changed, aren't under the user control?
Apple is so much in the wrong here.
This isn't true. I don't understand how people continue to make GDPR into this grandiose thing that does everything under the sun.
This is becoming the norm even in security/cryptography software like iOS and Signal and it’s terrifying.
This is absolutely not in any way a true statement. The GDPR applies to very specific things, and I don't think you could find a reading of it where it applied to maintaining the IDFA on a phone.
Pedantic, granted, but relevant in practice.
https://www.fastcompany.com/40403706/the-subtle-power-of-def...
https://noyb.eu/en/noyb-files-complaints-against-apples-trac...
Edit: NOYB (the NGO, "None Of Your Business") is probably one of the more cost-effective ways of supporting a fight for real privacy over corporate interest. Just in case people here are wondering where to put their holiday season donations...
iOS 14 was released in September. What a strange sentence, it's completely incorrect.
I cannot prove it, but this whole piece reeks of being algorithmically generated, and I do believe that this factual error is proof of that. Any human journalist operating in the field of technology would be well aware that iOS14 has already been released and would have phrased accordingly; I think that what we’re seeing here is some algorithmic synthesis of background facts (one of which was apparently source of confusion, because of references to iOS14 and postponement, not of the whole OS but of a relevant portion thereof).
In this article, I see nothing that indicates hitting.
They don’t even say the complaint is completely unjustified, just that it is inaccurate. That already is the case if only a small detail (for example if it says Apple uses the identifier, while they don’t) in the complaint to be incorrect. It doesn’t make the entire complaint invalid, though.
Reading https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX..., article 5.3:
“3. Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller.”
I would guess (one of) their arguments are that the ID in itself isn’t information and that it is up to those reading the ID to explain the purpose of processing the ID.
I think that makes sense, but also can be called factually inaccurate/incomplete. One could argue they collude with advertisers to track you.
> Apple uses a tracking technique called "identifier for advertisers" (IDFA). This technique assigns a unique identifier to every user who buys an Apple iOS device (such as an iPhone or iPad). This identifier is then used by Apple's advertising network, iAd, to determine the ads that individuals are viewing and responding to.
See Apple Advertising & Privacy [2] for details:
> To see this information on your iOS or iPadOS device, go to Settings > Privacy > Apple Advertising and tap View Ad Targeting Information. On Mac, go to System Preferences > Security & Privacy > Privacy, select Apple Advertising, then click View Ad Information.
[1] https://en.wikipedia.org/wiki/HTTP_cookie#Identifier_for_adv...
Apple aren't making money from my data behind my back. Apple have never stood accused of surreptitiously weaponising my own data against me. They are not collecting my data in order to target me with manipulative advertising or tailor algorithms to maximise engagement.
No one can assure the big companies turn out and against them. It's just my feeling about a big tech company always talk about privacy but its action seems not.
The current implementation of "IDFA" was an improvement on what came before it (unfettered raw access to the hardware UDID) and Apple have already announced that consumers will be actively prompted to approve IDFA usage in the near future.
I do worry that if collectively we act like nothing but absolute perfection can ever satify us, perhaps companies will feel no incentive to make progressive improvements to privacy.
Stop thinking so hard, consumer. Shouldn't you be watching football or shopping or something?
Eventually everything on the web will require payment without there being a universally supported payment method, which is what should be the solution everyone is working on (read an article, pay 1¢ out of a fund you provide under your control for example). But instead we get ranting about privacy. Shouldn't HN discussions be about finding a better way rather than ranting?
My programming blog used to get 300,000 readers a year, which would have netted me $3K a year at 1¢. I had too much work and gave had to give it up a couple years ago.
It is when you choose to install apps by third parties that the IDFA may be used.
The IDFA is also specifically designed so that it can not be used to track you across apps and sites, but only for limited cases by one vendor.
It is when you choose to have a pizza delivered to you, or a package sent to you by third parties that hidden cameras overlooking your bed, your kitchen, and your toilet, may be used.
The camera is also specifically designed so that it cannot be used to track you across other buildings, but only for limited cases by one vendor.
Do advertisers pay Apple for the use of IDFA?
Do I pay Apple for the phone?
You are saying people should pay for stuff OR get their data sold.
Where can I get my free iPhone?
It's not about the price of the phone. It's about the price of the services you get online—everything from Facebook to HackerNews.
Some of these free websites are subsidized by other means (like YCombinator itself). Some are funded by subscription, with a partial paywall that lets you access a portion of their content free. Others are funded by gathering your data and selling it to advertisers.
Stop treating Apple as if they're the ones who should be responsible for everything under the sun, just because they make iPhones (and truckloads of money).
To my knowledge neither Gigabyte or Intel (though TPM etc has other issues) pre-installed ad tracking in my system that I can't remove.
It's entirely about the price of the phone, if the thing I paid for is tracking me for ads.
Whether I use free web services that sell my data on my computer or not is, while interesting, a completely separate issue.
Someone doesn't want to pay to read your blog, what do you do? Allow shady third parties to install trackers on your readers' browsers to monitor what they are doing, without them really knowing nor understanding the long term consequences? I don't know about that...
Beyond privacy laws, there might be also allegation of fraud as their marketing campaigns seem to relies heavily on privacy and they seem to have a curious conception of it.
What, what? Does the article mesn the enhanced no-tracking functionality in Safari has been delayed?
I'm with the EU mostly on this one. Though I do think it's silly for them to pursue Apple at this point when they are already pushing to improve this.
Advertisements keep the internet going, if anyone has a different business model then please say it, because people right now are not willing to pay for news, social media or YouTube.
Because ads would be targeted at apps or publishers, not users, premium content would control the premium ad space. This would be good for content creators, consumers, and high quality sites / development houses. It would be bad for ad auction houses, but they don’t provide nearly as much societal value as the newspapers and magazines they replaced.
I don’t know how effective this is though.
When are we going to stop post stuff from reuters.com? For ages their GDPR pop up didn’t work.
They have a lot of click bait articles without any real content. This line is an example. It could have been like 1 paragraph.
They make inaccurate statements:
> The Californian tech giant said in September it would delay plans to launch iOS 14 until early next year.
No they said they will launch the feature later, not the OS.
//rant over
You cannot bypass it without consenting, it just won't close if you click "save preferences" without agreeing to things that seem to not be lawful with GDPR. They seem to think that there is somehow a "legitimate interest" for unnamed third parties to "Create a personalised ads profile" (and many more things) when I read an article on their website.
These "ad choices" screens conflate the legalese beyond recognition to make you give in to unlawful demands, which is their real purpose.
And undoubtedly my Apple advertising ID gets passed to these unnamed third parties in the process.
It needs to stop. And I don't care that companies might not be able to exist without it. Good riddance.
Good luck Max Schrems fighting this, and please add all these web publishers with their "Ad Choices" scam to your target list.
I do not know this company, Amplitude, and never consciously gave them permission to use my Apple IDFA or combine it with my browser cookies, yet I don't doubt they have an accurate combination of those about me and sell it to any client who can afford it. And that is what this article is about: Apple is enabling this at the source.
There are undoubtedly many more Ad-tech companies who market data they gathered about me without freely given consent. Again, it needs to stop.
It's worth noting that Apple has already chosen to kill off IDFA (something that was created as a transition away from developers having to the device's raw UDID) and Apple took this step without needing to be pressured by consumer rights groups.
You should read again. Under "Determining Unique Users" you can see they link every "device id" to a unique user ID. A device id can be a browser cookie, an Apple IDFA or an Android AdID.
> Apple took this step without needing to be pressured by consumer rights groups.
Well, Apple is a smart company and better than most others with privacy. They may have concluded for themselves that they would probably get under pressure for this.
IDFA is not available in Safari at all. The api is available only to App Store apps.
IDFA has nothing to do with browser cookies and is not combined with them.
Especially never talk to any ad-tech companies. They are worth billions, but really do not offer anything on top of what Apple and Google have in their docs about advertising.
Works perfectly here?
Those that need privacy won't use Apple.
Edit- What's wrong? Serious privacy users are going to use an obscure Linux distro. Don't believe the Apple "security theatre", it only puts you at risk.
Everybody needs privacy.
Do not confuse marketing with the actual service delivered.