Skip to content
Naked Security Naked Security

Apple’s new tracking protection is “sabotage”, claims ad industry

The ad industry is not happy with Apple's latest move to limit how we get tracked around the web.

The ad industry is gnashing its teeth over Apple’s latest move to limit how we get tracked around the web.

They’re concerned about the new version of Apple’s mobile operating system – iOS 11 – which will hit phones and tablets today.

To be clear, the arrival of iOS 11 doesn’t mean that the Safari web browser will stop sites from tracking you around. No, there will be no advertising Armageddon for the way that sites track visitors’ browsing from site to site. Marketers will still be able to do things like try to sell you flip flops after you 1) check out an online shoe store and then 2) visit a site that has nothing to do with Maui.

Tracking via cookies won’t come to a screeching halt, but it will, in fact, be corralled, as Apple described in June when it announced a feature called Intelligent Tracking Prevention (ITP).

ITP uses a number of methods to try to cut back on ad-tracking, one being to limit the use of cookies for ad retargeting to 24 hours, and deleting a site’s cookies entirely if you don’t visit for 30 days. If you visit, say, your favorite flip flop emporium on one day, then show interest in that same site within 24 hours, the technology will allow that domain to track you as you visit other sites by planting cookies to follow you around. If you don’t go back to the flip flop shop after 30 days, it will lose the ability to track you.

Well, that might sound reasonable to Apple, and it might sound reasonable to people who don’t really want to see irrelevant ads for the rest of their lives after accidentally stumbling onto fill-in-the-blank-dot-com by accident (all too easy to do when you’ve got ads popping up on mobile devices, where the X button is too tiny to hit with any accuracy).

But it doesn’t sound reasonable to the advertising industry. In fact, it sounds like internet sabotage.

Six major advertising consortia have signed an open letter to Apple in which they claim that Apple is replacing the current model of user-controlled cookie preferences with its own set of “opaque and arbitrary standards” for cookie handling.

It’s going to hurt users by giving them generic ads, they say. Thanks, Apple, the consortia say: you’re popping a hole in the internet’s economic model.

From the open letter, published in AdWeek last week:

Apple’s unilateral and heavy-handed approach is bad for consumer choice and bad for the ad-supported online content and services consumers love. Blocking cookies in this manner will drive a wedge between brands and their customers, and it will make advertising more generic and less timely and useful. Put simply, machine-driven cookie choices do not represent user choice; they represent browser-manufacturer choice.

Yes, machine-driven: as Apple announced in June, Safari has been outfitted with machine learning, built into its WebKit browser engine.

When it comes to cookies, there are a few types.

First-party cookies are planted by sites that we visit and can only be read by that sites that set them. Third-party cookies typically come from resources such as Facebook Like buttons or tracking scripts that are included in the pages we visit but are pulled in from different domains.  Third-party cookies can be used to track us as we move across sites that share the same third-party resources.

A first-party cookie set when you visit facebook.com can become a third-party cookie when you visit another site that includes resources from facebook.com.

Apple haven’t done a great job of explaining how their machine learning is being used but so far as we can tell it’s there to figure out which first-party cookies are allowed to become third-party tracking cookies on other sites, and which aren’t.

Despite the advertising consortia’s letter, Apple’s sticking with the plan. It said in a statement that it believes that people have a right to privacy, and ITP is a good way to protect that privacy:

Apple believes that people have a right to privacy – Safari was the first browser to block third-party cookies by default and Intelligent Tracking Prevention is a more advanced method for protecting user privacy.

Ad tracking technology has become so pervasive that it is possible for ad tracking companies to recreate the majority of a person’s web browsing history. This information is collected without permission and is used for ad re-targeting, which is how ads follow people around the internet. The new Intelligent Tracking Prevention feature detects and eliminates cookies and other data used for this cross-site tracking, which means it helps keep a person’s browsing private. The feature does not block ads or interfere with legitimate tracking on the sites that people actually click on and visit. Cookies for sites that you interact with function as designed, and ads placed by web publishers will appear normally.

This isn’t the first time that the ad industry has sent up distress signals over checks on advertising. Two years ago, the issue was adblockers, and the economic “sabotage” was framed in a claim from Adobe and PageFair that adblockers would cost businesses $22,000,000,000. That’s not a typo: they really did say that adblockers would cost businesses $22 billion, with a B.

Our readers heartily disagreed.

…and our own Paul Ducklin said at the time:

[A]ds in the face of people who don’t want them will almost always only ever get clicked by mistake (easy on a mobile). We’ve all done it – and we all probably just backed out from the ad right away. But dud clicks of that sort represent a completely wasted cost to any legitimate company buying ad clicks. So you might just as well argue that ad blockers will *save* businesses $Xm during [the coming year], by helping to protect well-meaning companies from paying for other people’s mistakes.

Is restricting tracking, as Apple is doing with the iOS upgrade, the same as blocking ads altogether (or as much as possible, given Google’s and Facebook’s skill at evading adblockers) with an adblocker?

Yes, Apple is taking more control of cookies. It’s not stopping ads. Rather, it’s reining in the enormously rich profiles that marketers construct via tracking and which enable them to target-market us.

Will that cause the internet economy to collapse? It’s hard to imagine that it would. Will it limit the annoying ads that follow us around everywhere we go?


9 Comments

“bad for the ad-supported online content and services consumers love” Those Trade Groups, might be smelling their own farts way to much.

Reply

“[Apple’s policy will] make advertising more generic and less timely”

Call me negative, but if I’m shopping for some bright red heels, yet 24h later still haven’t made a purchase…Cinderella has already missed the ball anyway, rendering the ad obsolete.

I believe timeliness is the opposite concern.

Reply

I use ad blockers, because i HATE the plethora of ads on some sites. Whenever an ad squeaks by, i stop using brand x that authorized an ad company to try and bypass my blocking tech. It show me that brand x, not the ad company, does not respect my desire for privacy, nor my desire to surf around unmolested.

Similarly, i also do not go to places like times square nyc, that have ads up everywhere, that are “in your face”

Product placement in entertainment (tv, movies, games) i find amusing, but will not purchase an item because i saw it from there, as i consider that toeing the line in invasive advertisement…only because that line is so thin, where it could turn into times square all over again.

Any app or any site that requires communication to c&c type servers (reimageplus is one example) has historically been plagued with bad actors who purchase slots on the good (and greedy) intentions of the ad management companies. I’ve seen malicious payloads push into otherwise (mostly) secure networks with that alone. Another reason to dislike that advertising world.

Reply

Dear Adweek – maybe if advertisers didn’t abuse us with auto playing audio and video we would not be so eager to block scummy advertisers.

Reply

This line in the ad industry group’s open letter to Apple highlights the solution: “Put simply, machine-driven cookie choices do not represent user choice; they represent browser-manufacturer choice.”

Users who don’t like Apple’s attempt to improve their privacy in Safari can choose to use a different “browser-manufacturer”.

Reply

Well, I don’t know. The fact that the content of ads might be tied to something I was browsing for recently was never my issue with ads. In the end this doesn’t do much for me as a consumer (granted the tracking data is only used for targeted advertising). As long as the ad is not a cancerous one, I think I might even prefer it to be possibly relevant to what I might be looking for at any given time. If the ad is cancerous, I couldn’t care less about the content. Funnily enough I might actually agree with the ad industry on this one, at least as far as that this would at best have no effect on me as a consumer and at worst make ads even less likely to be useful to me.

Reply

OK so maybe i’m missing some information here and not understanding the finer detail but if we think of these ads in terms of GDPR won’t they be in breach? Surely none of us want ads from sites we have been to to keep popping up on other sites and while we constantly see cookie notices as we visit a site, unless we confirm we do not want them then we get tracked. Should it not be the other way around, we should be giving the affirmative we want them, therefore if we ignore the cookie pop ups then we get tracked. I think DPA’s are going to have a field day next year!!

Reply

The signatories to the letter were:
American Association of Advertising Agencies (4A’s)
American Advertising Federation (AAF)
Association of National Advertisers (ANA)
Data & Marketing Association (DMA)
Interactive Advertising Bureau (IAB)
Network Advertising Initiative (NAI)

Don’t think I’ll lose much sleep over their hurt feelings.

Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?
You’re now subscribed!