Sophos News

Apple’s new tracking protection is “sabotage”, claims ad industry

The ad industry is gnashing its teeth over Apple’s latest move to limit how we get tracked around the web.

They’re concerned about the new version of Apple’s mobile operating system – iOS 11 – which will hit phones and tablets today.

To be clear, the arrival of iOS 11 doesn’t mean that the Safari web browser will stop sites from tracking you around. No, there will be no advertising Armageddon for the way that sites track visitors’ browsing from site to site. Marketers will still be able to do things like try to sell you flip flops after you 1) check out an online shoe store and then 2) visit a site that has nothing to do with Maui.

Tracking via cookies won’t come to a screeching halt, but it will, in fact, be corralled, as Apple described in June when it announced a feature called Intelligent Tracking Prevention (ITP).

ITP uses a number of methods to try to cut back on ad-tracking, one being to limit the use of cookies for ad retargeting to 24 hours, and deleting a site’s cookies entirely if you don’t visit for 30 days. If you visit, say, your favorite flip flop emporium on one day, then show interest in that same site within 24 hours, the technology will allow that domain to track you as you visit other sites by planting cookies to follow you around. If you don’t go back to the flip flop shop after 30 days, it will lose the ability to track you.

Well, that might sound reasonable to Apple, and it might sound reasonable to people who don’t really want to see irrelevant ads for the rest of their lives after accidentally stumbling onto fill-in-the-blank-dot-com by accident (all too easy to do when you’ve got ads popping up on mobile devices, where the X button is too tiny to hit with any accuracy).

But it doesn’t sound reasonable to the advertising industry. In fact, it sounds like internet sabotage.

Six major advertising consortia have signed an open letter to Apple in which they claim that Apple is replacing the current model of user-controlled cookie preferences with its own set of “opaque and arbitrary standards” for cookie handling.

It’s going to hurt users by giving them generic ads, they say. Thanks, Apple, the consortia say: you’re popping a hole in the internet’s economic model.

From the open letter, published in AdWeek last week:

Apple’s unilateral and heavy-handed approach is bad for consumer choice and bad for the ad-supported online content and services consumers love. Blocking cookies in this manner will drive a wedge between brands and their customers, and it will make advertising more generic and less timely and useful. Put simply, machine-driven cookie choices do not represent user choice; they represent browser-manufacturer choice.

Yes, machine-driven: as Apple announced in June, Safari has been outfitted with machine learning, built into its WebKit browser engine.

When it comes to cookies, there are a few types.

First-party cookies are planted by sites that we visit and can only be read by that sites that set them. Third-party cookies typically come from resources such as Facebook Like buttons or tracking scripts that are included in the pages we visit but are pulled in from different domains.  Third-party cookies can be used to track us as we move across sites that share the same third-party resources.

A first-party cookie set when you visit facebook.com can become a third-party cookie when you visit another site that includes resources from facebook.com.

Apple haven’t done a great job of explaining how their machine learning is being used but so far as we can tell it’s there to figure out which first-party cookies are allowed to become third-party tracking cookies on other sites, and which aren’t.

Despite the advertising consortia’s letter, Apple’s sticking with the plan. It said in a statement that it believes that people have a right to privacy, and ITP is a good way to protect that privacy:

Apple believes that people have a right to privacy – Safari was the first browser to block third-party cookies by default and Intelligent Tracking Prevention is a more advanced method for protecting user privacy.

Ad tracking technology has become so pervasive that it is possible for ad tracking companies to recreate the majority of a person’s web browsing history. This information is collected without permission and is used for ad re-targeting, which is how ads follow people around the internet. The new Intelligent Tracking Prevention feature detects and eliminates cookies and other data used for this cross-site tracking, which means it helps keep a person’s browsing private. The feature does not block ads or interfere with legitimate tracking on the sites that people actually click on and visit. Cookies for sites that you interact with function as designed, and ads placed by web publishers will appear normally.

This isn’t the first time that the ad industry has sent up distress signals over checks on advertising. Two years ago, the issue was adblockers, and the economic “sabotage” was framed in a claim from Adobe and PageFair that adblockers would cost businesses $22,000,000,000. That’s not a typo: they really did say that adblockers would cost businesses $22 billion, with a B.

Our readers heartily disagreed.

…and our own Paul Ducklin said at the time:

[A]ds in the face of people who don’t want them will almost always only ever get clicked by mistake (easy on a mobile). We’ve all done it – and we all probably just backed out from the ad right away. But dud clicks of that sort represent a completely wasted cost to any legitimate company buying ad clicks. So you might just as well argue that ad blockers will *save* businesses $Xm during [the coming year], by helping to protect well-meaning companies from paying for other people’s mistakes.

Is restricting tracking, as Apple is doing with the iOS upgrade, the same as blocking ads altogether (or as much as possible, given Google’s and Facebook’s skill at evading adblockers) with an adblocker?

Yes, Apple is taking more control of cookies. It’s not stopping ads. Rather, it’s reining in the enormously rich profiles that marketers construct via tracking and which enable them to target-market us.

Will that cause the internet economy to collapse? It’s hard to imagine that it would. Will it limit the annoying ads that follow us around everywhere we go?