Techniques used by developers to bypass App Store review
9to5mac.com
9to5mac.com
1. Make an API call to your server with the build number of the app.
2. Have that API response control whether the "secret" features are available.
3. Only enable each build's secret features once it's passed review.
4. Profit?
No dynamic/interpreted code required.
And there are sufficient variations on this that I would guess it's reducible to the halting problem and thus undecidable.
There should be a way to battle this outside technical measures, like a crowdsourced group of real distributed humans testing apps for anything malicious.
Though that's another story, targeted attacks will always find a way to slip through.
This method can protect the general public a bit more compared to the current "screening".
I guarantee they would get sued/attacked into oblivion, within a year or two. Look at what happens to Krebs. He gets SWATted, all the time.
They would need some good backing, and have to be subject to fairly stringent controls, themselves.
You see that stuff all the time, with even officially-sanctioned enforcement agencies. Amateurs won't have a chance.
You can detect both the triggered behavior and "hey this looks like a logic bomb" with static analysis. Yes, you'll never trigger this with some dynamic analysis of the app. But "hey, some code that does things associated with malicious or otherwise bad behavior is guarded behind branches that check for specific responses from the app developer's server" is often enough to raise your eyebrows at something.
But that would probably require some actual human code review, which costs $$s.
Apple could offload that to the developer in the form of review surcharges.
You'd find a code pattern that was being used, and declare it suspicious.
Rinse and repeat, as people are still going to try getting around the rules.
Eventually you're left with some weird subset of a subset of a language that's legal to write iOS apps in.
It’s a common fallacy to assume infinite worlds result in every possible world but 1, 10, 100, … is an infinite series but is only covering ~0% of possibilities.
More generally, any update check (is there a newer version available?) can double as a “is this version still in app review?” check.
It really means we need to lean into what ecosystem and government pressure we can apply to ensure the terms are sensible and fair because it will become nearly impossible to hack around them. (I do think many of these hacks are clever, I just don't think they will be enduring.)
I do agree that we need to continue to apply pressure to tear down walls around the garden as a means of protecting code as speech, including the ability to distribute and run it on our devices without burden.
The possibility of being banned from the Apple App Store ecosystem and/or legal reprisals is one way to deter unwanted behavior that can't be blocked through technical means.
“Executable Code Except as set forth in the next paragraph, an Application may not download or install executable code. Interpreted code may be downloaded to an Application but only so long as such code: (a) does not change the primary purpose of the Application by providing features or functionality that are inconsistent with the intended and advertised purpose of the Application as submitted to the App Store, (b) does not create a store or storefront for other code or applications, and (c) does not bypass signing, sandbox, or other security features of the OS.”
Hopefully the option is available to all Apple users since they do take a proud stance on user privacy. Having a blackbox browser like Safari or Webkit does still leave it open for Apple to potentially be able to see things Chrome cant' :)
I wonder if all it takes is having a device registered in the EU?
https://www.theverge.com/2024/1/25/24050478/apple-ios-17-4-b...
Review is for sizeable changes that are black and white across some lines, and also keeping malicious apps out. If it's not malicious, and updating for usage, maybe those are metrics that can be monitored and managed.
One feature set I notice is how many apps have you pay outside of Apple's walled system for a subscription because the actual work of the app is done in the cloud, and not entirely on device. Separating the app into a basic local app with extra work in the cloud seems to have merits, but with the increased horsepower on devices, it is more and more appealing to see what can be done locally.
If an app has a high level and clear enough layout, the details that fill them out can fill in.
I've been a fan of things like SDUI (Software defined UI) for a while, to allow more dynamic interface generation based on user preferences, usage, etc.
The approach of creating software that is for a fixed business process is more and more becoming outdated. Replacing fixed mindset software with software where flexibility is required, whether during the different stages of pandemic lockdowns, or truly personalizing a user's experience.
One could probably find a way of fingerprinting reviewer systems to directly hide the feature only for them.
We specifically allow-listed Apple's /8 range, but they don't always use the corporate VPN.
I set a timer for two weeks, after those the app started having its real behavior, with API calls and everything.
The whole Apple app review is a joke.
There are use cases for non-recurring week passes (eg. VPN app for a week during travel) but recurring weekly payments should require manual approval. Not all apps should be allowed to charge weekly recurring payments.
But then again the top-grossing apps are already scams and have been around for as long as I can remember so this is not new.
Ignoring the weasel wording in the sentence, and assuming the reviewers dedicate 100% of their time to reviewing and a standard work week, that's ≈12 minutes per app.
Why does Apple deserve the 30% cut, again?
Similarly, two companies, Apple and Google, shouldn't be able to keep 15% to 30% of all revenue generated in the entire mobile app market.
Life before app stores was a free market. And there was choice between app stores, and not.
Not so much anymore.
Convenience of an app store did bring an audience.
I can currently only jailbreak an iPhone due to mistakes made by Apple. It's conceivable that it won't be possible at some future point - though I'm not sure how this is relevant towards your earlier point?
> But even with a jailbreak, I’m not sure there apps, as opposed to tweaks that you could put on the iPhone.
There have been very limited workarounds on iPhones to enable sideloading, e.g. AltStore. These repositories are exactly the kind of apps you're looking for. But again, not sure how this is relevant towards your earlier point?
Apple has no control over your bank account and you have no control over Apple. You are both free to engage with each other or not.
Smartphones or digital literacy increasingly are not optional when it comes to accessing services in society including government.
Apple will have a bank account one day.
If X becomes the super app it’s aiming to be, it will be interesting to see how that plays out in North America.
Firstly the 60% have chosen iOS. They are not "hostage" they can leave. And this is not new behavior- it has existed since the iPhone shipped. Consumers are voting for this. [1].
Secondly Google doesn't control what you install, so by definition doesn't keep a potion of "all revenue". And most value from mobile apps comes from elsewhere [2], so even the Apple number isn't accurate.
As -developers- of course we want unfettered access to users devices to run any code we like. Unfortunately some proportion of developers want that access for reasons unhealthy to the consumer. So yes developers game the system. And your honest app gets rejected.
But it's worth understanding that users -want- this curated access, and are voting For it not Against it.
[1] you can argue about messenger, but that's about messenger not apps.
[2] most all apps I install are free. The company that makes them gets revenue from some other part of the system. We have a "free app" that integrates with our product (which people pay for).
Perhaps some of that mindset moved to the respective App Stores. User's don't have as much choice as people think.
The new App Stores being regulated in the EU are interesting for that reason.
Still reading about phones like WebOS on Palm that was maybe a year too late, could be a different world if we had a phone running JS as front end and for apps like it did.
Getting a walled garden up as quickly as possible was critically important.
Most of it concerned what good value 30% represented to handle hosting, billing and marketing for the developer
And this weekend, I'm starting to convert some of my old Mac (PPC era Java) shareware into web games so I can play them again. No ads, no cookies, hosted for free (for now) on github. I tried it out on my iPad, which didn't exist as a product when I wrote the original, and turns out this is fine.
* I can't be bothered to dig out the archive link for the pricing to figure out the exact percentage, there was both a fixed fee per transaction and a percentage fee that varied by payment method.
Apple didn’t want users doing what they wanted on their iPhone.
Only what was permitted. It’s nice that perspective evolved.
I don't like iOS and I don't like Android either ... now what choice do I have left? Getting an old Nokia?
It's about time to see that there's no choice and it's just a duopoly, even from the user point of view.
Realistically I don’t actually because I’m not rich enough and have no idea how start and run a company.
The current mobile market is locked-in and 10 billions wouldn't be enough to create a competitor.
Instead it's a demonstration of the power of two-sided markets. When Apple came out with the Apple ][, Silicon Valley had a competitive advantage in electronics because of networks across firms. Need parts? Need specialty talent? You got it.
Now the "competitive" edge of Silicon Valley is that it is the home of great monopolists such as Facebook, Apple and Google. That is, it crushed the competition and prevents it from emerging.
There's also the reality that (1) brands feel the need to express their brands through apps, (2) they are already annoyed enough that app development cost is at least doubled because you have to support iOS and Android, (3) many would express the belief that being forced to develop apps for a third (fourth, fifth, ...) mobile OS would be "extortion" or the equivalent. My understanding was that Windows Phone went EOL because carriers in the US were refusing to activate them because they too think it is bad enough to have to be able to deal with two OS.
If Android didn't exist, however, you'd probably being paying less than a 30% rake to the app store because the App Store would have been seen as a monopoly and the court would have done something about it. As it is the zombie OS Android doesn't really make money for Google or anybody else (Samsung is just proud it makes phones) and wastes money for app developers but it does make money for Apple. From that perspective a third mobile OS is like a fifth wheel.
There is such a thing as "pernicious competition" where fake competitors prevent the entrance of a real competitor, for years cable TV was a great example because you'd see several cable operators, several satellite operators, and later several IP based operators that all offered the same crummy channels with the same crummy UI at the same high price. Not only did the cable operators not serve the same customers but the structure of the industry caused them to "collude" to offer customers the same thing.
Android is like that. It adds $10-15 billion profit a year to the Apple App store just by keeping the court away.
Palm got stuck on Sprint and then bought and killed by HP.
Microsoft killed its own chances by not allowing Windows Phone 7 phones to upgrade to Windows Phone 8.
Consumers didn't choose in a free and fair market. The market was already set by the time most had even started getting smartphones.
At some point we have to admit that one of the main reasons for the duopoly is that the rest of the competition wasn't that good.
> Firstly the 60% have chosen iOS
Have we really made an informed choice or did I just go into a store to "buy a phone". I don't recall a booklet with each device what you can and can't do on it? e.g. iPhone "can't play Fortnite, Apple temporarily doesn't like Epic" would have been a good warning.
> They are not "hostage" they can leave
I think if you try changing ecosystems today, you will realise it's a very painful process. Apple and Google don't interoperate, don't follow standards (or just invent their own) and there are aspects of both ecosystems that are closed so no "move my stuff" app can ever be smooth and feature complete. Also, how do I convince my family and friends to switch so we don't downgrade to a green bubble situation.
There are pros and cons to any consumer choice. I think users are well informed an making their choice explicitly.
Yes, both eco systems employ lock-in and network-effects to keep customers. And yes that is an issue (separate from the app store issue.)
It may interest you to know that outside the US (and some parts of Europe) Apple has a smaller network share and people avoid the green bubble effect by using alternate messengers (mostly WhatsApp).
There are -choices- which you may or may not like. In the US folk have largely -chosen- to use iPhones despite Fortnite.
What's new is that Apple/Google now effectively control our lives. Their presence is everywhere.
And so yes, in this case it really matters what happens in every ecosystem. These corporations are effectively dictating policy for how my life is supposed to work, although nobody elected them, there is no oversight. I live in Europe, so both Apple and Google are really an ocean away in terms of mindset and values.
Tap to pay is your phone emulating an iso14443 smart card, which is what a contactless bank card is. Carrying a card is of course another thing to carry, but on the plus side they don't need charging every 24h and they won't be old tech next year when the iPhoxel n+1 incrementally better edition is released.
Much of the lock-in often comes from deep eco system integration which is also good for the user in many cases.
I think the argument of "people usually make zero consideration about what software choice is best for them" very much holds.
This claim you’re making here though is far more insidious. Who are you to decide what software choices are best for other people? I doubt most people care about ad blocking at all. But you think a persons right to make their own software choices should be restricted just because you think this is important? Why should anybody have any regard for what you think?
I also don't believe your implicit claim of people prefering watching ads over using an adblocker. I believe the vast majority of people would prefer a browser (or other software) that blocks ads over one that doesn't.
So if people know about adblockers and prefer not watching ads, why don't they use adblockers?
Because most people do not want to invest even a few minutes in finding the best option for them. They simply choose the default configuration of the software they have always used (e.g. Windows) or that they were introduced to by ads (e.g. Chrome).
I do believe that most people are capable of making the best decision; I don't think most people are willing to make the best decision.
People who aren't heavily into the topic will usually go with the default option. And that option is usually the worst.
(This isn't limited to software. There are many non-software products where I will chose the "default" option, too. Simply because I don't care about figuring out what the best option is for me. I will simply use the default: If it works, it's good enough. But I recognize that by doing so I, too, am promoting markets that are not trying to compete on product quality, but simply their marketing/advertising and the attention they get.)
The error you’re still making, and the source of the massive level of arrogance in this statement, is presuming you know what’s best for people.
Firstly, there’s plenty of things in my life that I have no interest in learning how to optimise, and this is the best decision for me, because I get what I want, and I don’t waste my time on something I don’t care about.
But even if I did suddenly take an interest in optimising one of these things, I’m sure as hell not going to do it based on your preferences, or the preferences of anybody other than myself.
Going through life assuming you know what’s best for everybody is not only incredibly arrogant, but it’s also incredibly dangerous. Because it naturally leads to you wanting to start making decisions for everybody else as well, and the idea that they might want something different to what you want doesn’t even seem like it’s conceivable to you.
So it's ignorant for them to say it, but correct and well-reasoned when Apple says they know whats best for people?
This is exactly why they're going to get legislated. You and Apple can maintain whatever weird interpersonal relationship you percieve while letting others sideload too. It's already happening in some parts of the world. Your ivory tower hasn't crashed-down yet; it's all just been fearmongering and whataboutism from people with $AAPL shares weighing down the perceptive part of their consciousness.
I agree that going through life trying to make decisions for people is a bad idea; that's why I reject the Play Store on Android and use F-Droid for better software. You should be allowed to do that on your iPhone; Apple is making your choice for you in an attempt to force you through their payment services. If that's not illegal bundling, then nothing is.
Your comment about payment services illustrates this perfectly. For starters, you're not forced to use it at all. Out of all the paid services I use on my phone, exactly none of them require me to pay via the App Store. I do however choose to use it for every single one of them, because the Apple App Store is by far the most consumer friendly subscription manager I’ve ever seen.
Can’t wait for the corporate lobbyists to take that choice away from me…
"Buy your mom an iPhone." - Tim Cook https://www.theverge.com/2024/3/21/24107676/buy-your-mom-an-...
> What you’re suggesting in this comment is that people shouldn’t be free to make that choice.
I am suggesting that people in other countries are already making that choice, and it hasn't even remotely impacted your or their freedom. In fact, users that live in countries covered by the DMA have more freedom to use their iPhone than ever before.
> Trying to claim that this isn’t well known
Well known by who? I know about it, you know about it. Look where we are and what we read.
If I ask my friends if they knew about this, the first thing most would say is "What's Flash?"
Many of them would say the App Store shipped with the iPhone on Day 1.
We are in a bubble, and it's not gaslighting to point that out.
> But you think a persons right to make their own software choices should be restricted just because you think this is important? Why should anybody have any regard for what you think?
This is always the argument peddled out, like "now you'll be forced to use these things". You like the Apple way, then keep doing that. I like the Apple way and will keep doing it. It's weird for you to describe being given additional options is having something 'forced' upon you, or that your choices are being 'restricted' by having additional options now. Now that is getting to some 1984-ish language games.
If there's a site with a really bad ad experience, such as audio playing video ads with audio, constant pop-overs, or using an ad vendor that allows ads to redirect or run super-heavy scripts, I simply stop visiting.
Short term, sure, blocking ads would be in my interest. Longer term, having content producers I'm interested in be able to get paid, and thus be able to continue to produce content is in my best interest.
Installing software that puts me one malicious update away from surveillance and/or credential theft, however unlikely, is not something I want to do. Perhaps there are protections against such things in the browser, and perhaps there are workarounds against those protections. Keeping up with the latest security status of browser plugins isn't something I want to invest any time in doing, and not something the majority of people would be able to do.
Your are are hostage once Apple stops supporting your device, and it becomes officially impossible to install any software on it. Consider the case of a perfectly functioning iPad 4. If I wipe it and hand it to my nephew, there's nothing he can do with it. Nothing in the AppStore will install on it, and sideloading is impossible. Aside from chucking a perfectly working device into the e-waste, which I hate to do if someone else might get a year out of it, the only other options are complex, dubious hacks.
Odd, because my old Apple devices still let me sign in and offer me the last compatible versions of a lot of software, something Google doesn't do.
At the time only Google supported devices more than 1-2 years. Every Android partner had zero support. The message was clear. Switch to iPhone if we wanted >1-2 years of support, so we did, and we've been happy since (~15 years).
That does not make me jump for joy. Instead it tells me that I don't wanna touch another Apple product.
Well if your argument is: “a perfectly good 10 year old iPad is held hostage by Apple because they don’t provide side loading” then isn’t that the same case with your perfectly good 10 year old Toyota? Or 10 year old Target Toaster oven or 10 year old Samsung fridge?
I think we will live in a strange world if we start demanding our refrigerators allow side loading YouTube.
A good 10 year old Toyota can have its head unit replaced and you can add new features if you so chose. When I was a kid it was a rite of passage to mod at least your speaker system.
> Or 10 year old Target Toaster oven or 10 year old Samsung fridge?
> I think we will live in a strange world if we start demanding our refrigerators allow side loading YouTube.
You set up a strawman argument. Who is demanding this of fridges and toasters?
It's odd that people will defend Apple for this, or laugh when you say that you want to use a 10 year old device, when on the same forum people applaud when someone blogs about getting their old Commodore / Sinclair / Toshiba 8bit to connect to the Internet. Wait, is the iPad too old to be useful, but simultaneously not old enough to be worth repurposing?
The iPad 4 has wifi, bluetooth, a retina screen and several days of idle battery life. If I could install a terminal and a VNC client, I could save this thing from e-waste for another 5 years. The way some people talk on here, it'll like they think that there's something wrong with that.
Why does everyone on HN promote laying down and giving up when your manufacturer tells you not to do something that loses them money? It's like there isn't a living hacker left on this website.
Do you really think that the web browser is going to load those pages? Try using a really old web browser on the web today and see how far you get.
> Well if your argument is: “a perfectly good 10 year old iPad is held hostage by Apple because they don’t provide side loading” then isn’t that the same case with your perfectly good 10 year old Toyota? Or 10 year old Target Toaster oven or 10 year old Samsung fridge?
Your fridge still keeps things cold. Your Toyota still drives. Your toaster still makes toast. What does a ten year old iPad do besides collect dust because all of the features you bought it for don't work anymore?
I'm in the same boat here. The AppStore endpoints have stopped being supported so I can't even sign in and forget about trying to update iOS.
Disclosure: I work at Google but not on Android.
Apple is the company that gates iMessage because if they don't, in Craig Federighi's words, they are "[removing an] obstacle to iPhone families giving their kids Android phones".
I also cringe at the corporate speak of "iPhone families". "We're an iPhone family". What?
This is just objectively not true. The nature of green vs blue messages feeds into the in-group out-group dynamics that humans (children and adults alike) are prone to.
This is by design. This works well for apple.
Now the obvious solution is for the group to pick a cross-platform chat app and use that, but it's weirdly difficult to get a group of people to do that. Sometimes they would rather exclude someone from the group than switch apps, which might suggest that the excluded person needs better friends.
Obviously if you ask people, they'll say they don't want to not be able to install some apps on their phone, they don't want to destroy the environment, they want an honest government, etc. Yet when it comes time to act, they act contrary to all the above, because it's so hard to act otherwise.
This is like saying shopkeepers are happy with mafia protection because they keep paying for it.
Bad choice 1, or bad choice 2 is not really choice. At this point a phone is a utility, as it’s nearly impossible to get through life without one.
While true (and indeed so generalisable that one can say this of e.g. two-party politics), there are phones which ship with other app stores (Samsung's Galaxy Store).
Also: so far as I can tell the specific apps you need to get through life are themselves not monetised via the app store — e.g. banking apps, healthcare, and (as I read it) items bought within but not used within apps (such as groceries or travel passes) would not be subject to any commission from Apple.
I can "leave" Subaru. I can't "leave" a mobile operating system without pain.
Some pairs might have lesser pain, such as Linux to different Linux distribution or Mac to/from Linux, if you mostly stick to more basic command line stuff, but the same is true for mobile device operating systems if you just stick to the basic mobile phone stuff which would be telephone, SMS messaging, camera, calendar, web browsing, and non-cloud syncing.
Can you book slots with TSMC for 3nm chips to put in another device?
Do you have hardware and software patents on obvious design patterns that users like?
There is no choice.
I imagine if Google or Microsoft turned up to TSMC and offered to beat Apple's price with similar guarantees of volume and capacity utilisation, TSMC would be happy to have that conversation, yes.
Competition laws are about fostering competitive markets. Customers and what they want is completely irrelevant past establishing that the market is not competitive.
Are you assuming users would still feel this way if they were made thoroughly aware that Apple's intermediation increases the prices of app services by up to 43%?
On one hand, they appoint themselves as bouncers for their respective stores - both claiming to keep end users safe.
On another hand, they both allows themselves flexibility in selectively applying the rules when the app in question is lucrative or somehow related to their numerous other product categories.
Who is watching the watchers?
Hmm. Gambling. Money. I see now why Apple allows gambling apps. Such moral finery in effect.
I should be able to install video download tools on my purchased device.
They are tools. Apple should not be in the business of policing what you do with tools.
That’s like saying GM shouldn’t sell cars that can drive over the speed limit.
What are your plans about this?
Also Android doesn’t have this problem. If you don’t want bad software don’t install it.
Microsoft Defender, SmartScreen...
There are users who want (or need) a curated, trustworthy experience. For them, an app store that heavily reviews all apps allowed on there and puts lots of restrictions on what they are allowed to do is ideal. There are also users who want to take the responsibility on themselves. They want the ability to host their own apps for free (or lower costs), faster update cycles, and just overall freedom. Those people don't want a highly curated app store (or rather, they want a co-existing alternative to the highly curated app store).
Perhaps the ideal situation would be that device comes with one default app store. That app store is highly curated and selective but it also allows other app stores on it. Those app stores can be reviewed in terms of their own quality but not on the quality of the apps they allow installing. The default app store can have huge warnings that these other store-like apps are not like the other apps and should be used carefully.
Why force Apple to make that App Store? This is what every argument like this boils down to. Apple are free to have their own opinion of what they want their product to be, and a tightly integrated experience is that opinion.
If users want something else, they can go elsewhere. If there is enough market demand for this, a company will exist and provide a product for it because that’s what companies do. But there isn’t, so they don’t.
> Apple are free to have their own opinion of what they want their product to be
While this would be fine in a free market with lots of competition, the market does not have that competition. Regulations are necessary so that the individual players in the market can't carve off their own separate realm. Apple is free to have a very tightly integrated experience with their devices and their app store and the very rigorously reviewed apps on that app store. It isn't like a non-default app store will destroy that. But that shouldn't mean that the users who are fine with a slightly less integrated experience for more freedom and control should be left without a choice.
> If there is enough market demand for this, a company will exist and provide a product for it because that’s what companies do.
There also needs to be space for such a company. No one (or mostly no one) will package their apps for a new OS so a standardised app format is required. No one will trust their phone number and identity and everything related to that to a new provider so a standardised way to switch the provider needs to be provided. Etc.
Make it so that I can switch out one part of the experience and the rest of it can't just refuse to work.
https://hbr.org/2021/02/facebooks-misleading-campaign-agains...
It's crazy that we don't have this kind of thing with digital platforms. Basically the platform owner is legislator and judge at the same time.
Let me say it again, if you hate government regulation then you haven't seen a company regulate a market.
- Newspapers: editorial and advertising (avoid that companies who pay for ads influence opinions)
- Banks: ‘origination’ and wealth management (avoid selling financial products created by bank to customers that trust the bank with managing their money)
Not sure if these dynamics are enforced by law, but pretty clear that there’s a need for the separation.
The Apple app market exists only because users trust it. They don’t trust you, and with good reason. You pay Apple a tax to gain the benefits of that trust.
I thought it was about how they get Apple to allow those $50/month subscriptions for the flashlight apps...
Hiding a functionality from Apple is a ticket to account and company ban and is not worth the hassle. Unless it was the intention of the whole enterprise.
It would be hard to wait for (up to?) weeks waiting for an app update to be approved.
I would not mind Apple doing whatever the reviews they want with their own private AppStore if I, the user, could install whatever app I need on the device that I bought by downloading it directly from developer's website.
Apple maliciously tries to stand between developers and users, with the intent of extortion. Big Brother 2024.
I don’t see a reason to name Microsoft’s solution specifically.
Firstly, there are other alternatives; also, Microsoft is shutting down parts of their offering; finally, JS apps are comparatively easy to update - even without a tool like this too.
https://youtu.be/Cw7wke_FtuI?si=3b6f3Ohd4wb_0xVS
Despite (and due to) its very much non-family-friendly title it managed to gain considerable attention before being taken down.
I've reported malicious apps.
Provided detailed evidence, etc.
Their security team told me to fuck off.
So I went back to my daily life...
At least I can say I tried. Security doesn't matter; it's the appearance of security that does.
Apple is like the walled fortress with armed guards in freshly pressed uniforms that wave most people through the gate and never check their trunks.
It is incredibly hard to get through to a human with the powers to actually solve problems in these tech companies. I've been through it many times. Often the algorithm's say is final and you can't get through to anybody able to override it. It's even worse when the decision is made by machine learning because it's a black box, and they can't even explain why the decision was made.
It's commonly accepted among tech savvy Apple users, and developers that Radar (bug tracking) was essentially a black hole. You could see what you sent to it, but you couldn't see any information on your report.
That site has the most evil consent UI I’ve seen. Not only does it require you to click zillions of checkboxes to withdraw consent, while allowing you to give it with a single click, it also hides most of them behind a “more” button. It’s amazing how many companies claim to have legitimate interest in tracking things…
This is against the GDPR (and no better than just not having a consent flow in the first place) but is allowed to continue since nobody cares about enforcing it.
Actually, the only reason the consent flow is there is because advertising providers require it (but only require the presence of one, ignoring the actual GDPR compliance of it).
More likely their legal checkbox is that GDPR rights are properly protected, such as via a consent flow, if needed. That normally requires an assessment of the rights impacted, the data collected, and the required consents, and an implementation of the flow itself to cover that.
This assessment has to be done by the app or website displaying the advertising. And also by the advertiser. As you can probably guess, writing such an assessment is knowledge work and costs time. People quickly noticed that if they just skip this and put in a consent flow, bogus or not, no one will care... So money saved?
Probably the market was right, most companies will save money that way. Which is both unfortunate but also logical.
However, it's also a huge legal liability if your app or website operates in certain sensitive domains. Such as healthcare and politics, and possibly social media.
Because it may turn out the product didn't have the right to collect any data. And that sensitive data was collected (could be inferred). And that the advertiser should have known this, because of a bogus implementation consent flow.
Then the final question is: What's the damage? Why is this is a 'huge' liability?
Answer: At this stage you're looking at class actions in the US, or 'snipperschade' claims (mass 'little-damage' renumeration) in the EU.
Art. 82 of the GDPR provides for the possibility of compensation, including for immaterial damage. Successfully claiming damage under that article lacks a large corpus of case-law. It is 'in development'. Largely because the requirements of evidence are difficult to meet in most cases. Especially those not involving sensitive categories of data.
In the event of a mass art. 82 claim for sensitive data, one may expect both the advertiser as well as the product displaying advertising to be targeted. And lawyers would be incentivized to pursue this via a mass 'class' action. Which magnifies the claim to a portion of the affected EU population (500 million) and an amount of monetary compensation.
So let's say 2,500,000 * 30 euro's = 75,000,000. So a fairly small portion of people (0,5%) and a small amount of remuneration. Amounts to 75 million in damages. Lawyers take home a percentage of that.
In essence this is a lawsuit waiting to happen. But probably not to you, and not to this app.
You might like/hate this.
Also, so funny how 9to5mac messages this. When Apple makes a misstep, it is developers "tricking" App Store, not Apple's incompetence. Lets call it what it is, Apple's review process is mostly security theater.
There is no 100%