9 ms·

Just a friendly reminder of the facts on the ground that the change that great folks at El Reg are reporting on and the folks at Facebook in their blog post are

by SllX 6y ago

Just a friendly reminder of the facts on the ground that the change that great folks at El Reg are reporting on and the folks at Facebook in their blog post are posting about is a toggle in iOS 14, which while there in previous operating system releases as an opt-out toggle, will be an opt-in sort of toggle. iOS will now ask for explicit permission on behalf of Apps to let them track you using an identifier Apple made available to developers like Facebook (“IDFA” aka “Identifier for Advertisers”) rather than relying on the implicit permission of an opt-out toggle. This does not kill all forms of tracking, nor does it eliminate IDFA as an an option, but it does make it more obvious to iPhone/iPad users what exactly is going on behind the curtains with this tracking tool and let them make an informed and explicit choice about whether they want any part of that.

bad_user 6y ago
I always wondered if that advertising ID is GDPR compliant, given that the setting is currently opt-out, instead of opt-in. Even if it is low entropy.
- Nextgrid 6y ago
  I don’t think it would be, however the party considered in breach would be the app developers and not Apple. Consent should be opt-in and granular (a user might wish to opt-in for one app but opt-out for another one) so every app should’ve already implemented their own toggle (like iOS 14 would force them to) instead of just using it in the background and pointing users to the system-wide setting if they want to opt-out (which isn’t ideal if the user wants to remain opted-in for some apps only).
  - krageon 6y ago
    > the party considered in breach would be the app developers Given that this feature is entirely made by Apple, that's not a reasonable conclusion.
    - wastedhours 6y ago
      Isn't it down to the app developers though whether they allow the ID to be used to serve ads in their app (whether or not in practice there's a mechanism to do that, it's the app developer that's essentially choosing to use it by implementing ad networks and SDKs that use it, not Apple forcing it on them).
    - rsynnott 6y ago
      Your browser (probably) allows the use of cookies; however a website which doesn't ask the user for appropriate permission is still in breach of the law.
    - kergonath 6y ago
      It’s not Apple doing the tracking. The knife manufacturer is not reaponsible if you stab someone.
  - bad_user 6y ago
    IANAL. Not sure about that. IDFA is essentially a tracking cookie. First of all under GDPR, tracking can be for a legitimate interest, and thus it might not require opt-in. For example security, or even first-party analytics, with the purpose of optimizing the content, can be legitimate interests. However this cookie is meant for advertising, and user profiling for marketing purposes doesn't pass the test for legitimate interest. The other problem, for Apple, might be the revised E-Privacy Directive. You can't set such tracking cookies without informing users. Such cookies must be opt-in, whether you use them or not. AFAIK Apple is simply complying with the law, whereas Facebook is effectively arguing for unlawful tracking, because that's just who they are.
- MilaM 6y ago
  My understanding is, that it's a random and unique identifier, and therfore very high entropy. Pooling that data allows FB to identify you in different apps that use the SDK, even if they don't have any other identifying info.
DaiPlusPlus 6y ago
“IDFA” is too similar to “IDKFA”... or “IDGAF”. I’m sure there’s a joke in there...
- unlogic 6y ago
  IDFA is a cheatcode of its own (ID Full Ammo).
- agustif 6y ago
  The opt-in label for it in seettings should be. I Don't Fucking Agree
kreetx 6y ago
Is this a cross-app identifier for non logged-in users? I.e if you log in to an app then that provides the tracking identifier (email).
- thor24 6y ago
  Yes. IDFA's full form is "The Identifier for Advertisers" which is generated by OS itself. Think of it like a proxy of IMEI number itself (back in the old days IMEI itself was used instead of this). All of the Apps get the same ID and that's how your "persona" graph is constructed. Sidenote: One of the bets people are making with this change is that now free apps will start forcing you to signup (via email/mobile number) which will be used to construct this "persona" graph again because who has time to create new emails for these purposes.
  - occamschainsaw 6y ago
    Well, your phone has the time to create new emails for these purposes with the Sign In With Apple feature[1]. You don't have to remember your email nor your password because iOS can create a secure one and save it on your phone. More secure than people using the same email and password across multiple apps imo. [1] https://developer.apple.com/sign-in-with-apple/ https://developer.apple.com/sign-in-with-apple/
    - jonplackett 6y ago
      I wonder if Apple saw this coming and created Sign in with Apple in anticipation. Seems like a very smart play now.
      - jaywalk 6y ago
        You wonder if Apple saw a change in their own policy coming? Yes, I think they may have...
        jonplackett 6y ago
schoolornot 6y ago
This does not kill all forms of tracking What mechanism remains for tracking a user across apps?
- SllX 6y ago
  Anything that doesn’t rely on IDFA, e.g. your Google account in Google’s Apps. But I was thinking more about tracking within apps that isn’t concerned with tracking across apps or even tracking for advertising purposes, hence, “does not kill all forms of tracking”.
- tantalor 6y ago
  IP addr
  - sheeshkebab 6y ago
    Prob more a combination of IP address, user agent, iPhone model, plus prob some other device fingerprinting identifiers these ad trackers found
  - K0nserv 6y ago
    While Apple are limiting access to IDFA for apps that don't ask for permission to track i.e. it will be all zeros they are also changing App Store policy. Specifically you are not allowed to track users using identifiers such as user ids, fingeprint ids etc if they have said that they don't want to be tracked. Sure Apple doens't have technical control over this but we know that they are willing to wield the ban hammer. It'll be really interesting to see this play out. The experiment with the "Do Not Track"[0] header on the web failed becaused it was largely ignored by everyone. With Apple's tight control over the App Store you simply cannot ignore the rules because Apple can outright ban you for it. 0: https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track
    - tantalor 6y ago
      I doubt Apple would ban an app as valuable as Facebook.
unishark 6y ago
So do they still run but are limited like when ios gives the false location data? or can facebook apps just refuse to operate until they are given the required permissions? E.g. the way android apps just demand permisions for everything making the security benefit of permissions largely pointless.
- SllX 6y ago
  Programmatically? Certainly. As a matter of App Store policy? Facebook shouldn’t count on it, even if that were allowed by the rules as written today (which I don’t think it is, but Apple has pretty much covered all of their bases as far as arbitrarily changing policy on the fly goes).
- dwild 6y ago
  > the way android apps just demand permisions for everything making the security benefit of permissions largely pointless. That hasn't been the case for a pretty long time. Now the permissions are quite granular and you can accept and refuse specific one at any time. It's actually quite tiresome to go through 4-5 permissions popup on some apps, but it makes sense so it's okay. The apps is informed of that decision, so yeah it can decide to not works without it. I suggest you to not use an app that require stuff that you don't want to allow.
  - Causality1 6y ago
    Though it's bizarre to me what permissions require a pop-up and which don't. You think all you've granted is, say, looking at files, then you check the actual granular list and there's a dozen different ones including internet access.
    - nitrogen 6y ago
      Making full network access a mandatory always-on permission was a huge security mistake IMO. Every app can port scan your network, and probably some do as part of fingerprinting (some websites do at least, and I assume apps are more brazen).
masto 6y ago
It pops up a big scary per-app dialog (https://mobiledevmemo.com/wp-content/uploads/2020/06/image-12.png https://mobiledevmemo.com/wp-content/uploads/2020/06/image-1...) that the app wants to “track you across apps and websites owned by other companies”. I just wish people understood how much they’re being manipulated by Apple’s marketing here. Credit to them: they’re the best in the world —- if Tim Cook decided to sell cigarettes, he’d have most of us on two packs a day and believing it’s good for us by Christmas. Apple is a giant corporation, they’re not your friend. They can be total jerks when it suits them. They happen to have failed at their own advertising network and had the brilliant idea to spin this as if they “care” about your “privacy”. It is a convenience of the moment to sell more devices like the iPad Pro I’m typing this on. The level of rhetoric has reached foaming-at-the-mouth proportions, and we can no longer have a rational discussion that acknowledges the nuances. Even the word “tracking” is so loaded with evil connotations and indistinguishable in most people’s minds from the ever-cited, rarely existent “selling my personal information” that few can see beyond the word to make a conscious choice about what level of tracking is acceptable. (NONE! I can already hear the shouting.) IDFA is a random identifier that’s been used for attribution and audience targeting (for which Apple provided it). Digital advertising has a fairly unique property, which is that it’s possible (at least sometimes) to connect the dots between “I paid for an ad for my product” and “someone bought the product”. If you’re spending money on advertising and offered the choice between casting it into the void and hoping your sales pick up, versus only paying for successful “conversions”, that second option is going to be pretty attractive. I saw an ad on Facebook for a food delivery service. I signed up and have been enjoying their products and benefitting from fewer grocery trips. I’m ok with that. And I’m ok if there was a little anonymous tag that allowed Facebook to get paid for the service they provided to the company. I’m less ok if they collect information on how much red meat I’m buying and sell it to my insurance company, but that’s not what we’re talking about here and I pretty wound up when people assume that all “tracking” is the same.
- jonplackett 6y ago
  I disagree. 1) Marketing alone is not why you have an iPad Pro. All other tablets kinda suck compared to it. It's at least 5 years ahead of anything else in hardware and the software is probably further than that. 2) Facebook also not your friend. Corporations can't be friends. 3) Why would anyone _want_ to be tracked if they can avoid it? 4) From a business' POV, sure tracking is useful, but as a consumer, I don't care. I would rather not be tracked - in this instance I think it's nearly even possible to say Apple are being my friend, working for my interests. Also IDFA was introduced as a more private device ID, I doubt they expected it to be exploited this way and are now fixing it. 5) The reason FB cares about this tracking isn't for tracking installs of other apps, it's about their ability (or not) to build up a comprehensive identity of who you, what you do, where you go and what you like, from all the apps and websites you've ever visited.
CWuestefeld 6y ago
I was going to protest what sounded like a silly taunt of "great folks at El Reg". Then I went and read the article. Holy mackerel, compared to this, the folks at Fox and MSNBC are paragons of neutrality. This may be the worst example of journalism I've ever seen. I'm looking all over for something that says "opinion" or "editorial", but no...
- dekhn 6y ago
  The Register basically emulates british tabloids.
  - sroussey 6y ago
    With celebrity nicknames for companies and all!
- SllX 6y ago
  I was sincere, I love The Register! But there was an actual taunt in that sentence that was much more subtle. Notice what I didn’t say after talking about the “great folks at El Reg”.
- srmatto 6y ago
  Have you ever read The Register? Its been this way as long as I can remember (1999?). I consider it more of a cheeky, poking-fun style rather than it being inflammatory. They've always created an air of not taking IT/Technology too seriously. Take this job listing for example: https://www.theregister.com/Page/devoops.html https://www.theregister.com/Page/devoops.html 1. DevOops.html 2. Titled: "Vultures seeking penguin-tamer"
  - egypturnash 6y ago
    I feel like the fact that The Register has been the Internet home of the Bastard Operator From Hell stories (https://en.wikipedia.org/wiki/Bastard_Operator_From_Hell https://en.wikipedia.org/wiki/Bastard_Operator_From_Hell) since 2000 really sums up its attitude. It is tech news by and for BOFHs.
fencepost 6y ago
And a friendly reminder that if you're on iOS you can go into Settings, search for "advert" and limit ad tracking if you managed to miss that setting before.
autisticcurio 6y ago
Well Facebook make their money from advertising, marketing is advertising so it seems like Apple are taking cues from some laws and customer demand. https://www.gov.uk/marketing-advertising-law/direct-marketing https://www.gov.uk/marketing-advertising-law/direct-marketin...

by SllX 6y ago

bad_user 6y ago

I always wondered if that advertising ID is GDPR compliant, given that the setting is currently opt-out, instead of opt-in. Even if it is low entropy.

Nextgrid 6y ago
I don’t think it would be, however the party considered in breach would be the app developers and not Apple. Consent should be opt-in and granular (a user might wish to opt-in for one app but opt-out for another one) so every app should’ve already implemented their own toggle (like iOS 14 would force them to) instead of just using it in the background and pointing users to the system-wide setting if they want to opt-out (which isn’t ideal if the user wants to remain opted-in for some apps only).
- krageon 6y ago
  > the party considered in breach would be the app developers Given that this feature is entirely made by Apple, that's not a reasonable conclusion.
  - wastedhours 6y ago
    Isn't it down to the app developers though whether they allow the ID to be used to serve ads in their app (whether or not in practice there's a mechanism to do that, it's the app developer that's essentially choosing to use it by implementing ad networks and SDKs that use it, not Apple forcing it on them).
  - rsynnott 6y ago
    Your browser (probably) allows the use of cookies; however a website which doesn't ask the user for appropriate permission is still in breach of the law.
  - kergonath 6y ago
    It’s not Apple doing the tracking. The knife manufacturer is not reaponsible if you stab someone.
- bad_user 6y ago
  IANAL. Not sure about that. IDFA is essentially a tracking cookie. First of all under GDPR, tracking can be for a legitimate interest, and thus it might not require opt-in. For example security, or even first-party analytics, with the purpose of optimizing the content, can be legitimate interests. However this cookie is meant for advertising, and user profiling for marketing purposes doesn't pass the test for legitimate interest. The other problem, for Apple, might be the revised E-Privacy Directive. You can't set such tracking cookies without informing users. Such cookies must be opt-in, whether you use them or not. AFAIK Apple is simply complying with the law, whereas Facebook is effectively arguing for unlawful tracking, because that's just who they are.
MilaM 6y ago
My understanding is, that it's a random and unique identifier, and therfore very high entropy. Pooling that data allows FB to identify you in different apps that use the SDK, even if they don't have any other identifying info.

DaiPlusPlus 6y ago

“IDFA” is too similar to “IDKFA”... or “IDGAF”. I’m sure there’s a joke in there...

unlogic 6y ago
IDFA is a cheatcode of its own (ID Full Ammo).
agustif 6y ago
The opt-in label for it in seettings should be. I Don't Fucking Agree

kreetx 6y ago

Is this a cross-app identifier for non logged-in users? I.e if you log in to an app then that provides the tracking identifier (email).

thor24 6y ago
Yes. IDFA's full form is "The Identifier for Advertisers" which is generated by OS itself. Think of it like a proxy of IMEI number itself (back in the old days IMEI itself was used instead of this). All of the Apps get the same ID and that's how your "persona" graph is constructed. Sidenote: One of the bets people are making with this change is that now free apps will start forcing you to signup (via email/mobile number) which will be used to construct this "persona" graph again because who has time to create new emails for these purposes.
- occamschainsaw 6y ago
  Well, your phone has the time to create new emails for these purposes with the Sign In With Apple feature[1]. You don't have to remember your email nor your password because iOS can create a secure one and save it on your phone. More secure than people using the same email and password across multiple apps imo. [1] https://developer.apple.com/sign-in-with-apple/ https://developer.apple.com/sign-in-with-apple/
  - jonplackett 6y ago
    I wonder if Apple saw this coming and created Sign in with Apple in anticipation. Seems like a very smart play now.
    - jaywalk 6y ago
      You wonder if Apple saw a change in their own policy coming? Yes, I think they may have...
      - jonplackett 6y ago

schoolornot 6y ago

This does not kill all forms of tracking What mechanism remains for tracking a user across apps?

SllX 6y ago
Anything that doesn’t rely on IDFA, e.g. your Google account in Google’s Apps. But I was thinking more about tracking within apps that isn’t concerned with tracking across apps or even tracking for advertising purposes, hence, “does not kill all forms of tracking”.
tantalor 6y ago
IP addr
- sheeshkebab 6y ago
  Prob more a combination of IP address, user agent, iPhone model, plus prob some other device fingerprinting identifiers these ad trackers found
- K0nserv 6y ago
  While Apple are limiting access to IDFA for apps that don't ask for permission to track i.e. it will be all zeros they are also changing App Store policy. Specifically you are not allowed to track users using identifiers such as user ids, fingeprint ids etc if they have said that they don't want to be tracked. Sure Apple doens't have technical control over this but we know that they are willing to wield the ban hammer. It'll be really interesting to see this play out. The experiment with the "Do Not Track"[0] header on the web failed becaused it was largely ignored by everyone. With Apple's tight control over the App Store you simply cannot ignore the rules because Apple can outright ban you for it. 0: https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track
  - tantalor 6y ago
    I doubt Apple would ban an app as valuable as Facebook.

unishark 6y ago

So do they still run but are limited like when ios gives the false location data? or can facebook apps just refuse to operate until they are given the required permissions? E.g. the way android apps just demand permisions for everything making the security benefit of permissions largely pointless.

SllX 6y ago
Programmatically? Certainly. As a matter of App Store policy? Facebook shouldn’t count on it, even if that were allowed by the rules as written today (which I don’t think it is, but Apple has pretty much covered all of their bases as far as arbitrarily changing policy on the fly goes).
dwild 6y ago
> the way android apps just demand permisions for everything making the security benefit of permissions largely pointless. That hasn't been the case for a pretty long time. Now the permissions are quite granular and you can accept and refuse specific one at any time. It's actually quite tiresome to go through 4-5 permissions popup on some apps, but it makes sense so it's okay. The apps is informed of that decision, so yeah it can decide to not works without it. I suggest you to not use an app that require stuff that you don't want to allow.
- Causality1 6y ago
  Though it's bizarre to me what permissions require a pop-up and which don't. You think all you've granted is, say, looking at files, then you check the actual granular list and there's a dozen different ones including internet access.
  - nitrogen 6y ago
    Making full network access a mandatory always-on permission was a huge security mistake IMO. Every app can port scan your network, and probably some do as part of fingerprinting (some websites do at least, and I assume apps are more brazen).

masto 6y ago

It pops up a big scary per-app dialog (https://mobiledevmemo.com/wp-content/uploads/2020/06/image-12.png https://mobiledevmemo.com/wp-content/uploads/2020/06/image-1...) that the app wants to “track you across apps and websites owned by other companies”. I just wish people understood how much they’re being manipulated by Apple’s marketing here. Credit to them: they’re the best in the world —- if Tim Cook decided to sell cigarettes, he’d have most of us on two packs a day and believing it’s good for us by Christmas. Apple is a giant corporation, they’re not your friend. They can be total jerks when it suits them. They happen to have failed at their own advertising network and had the brilliant idea to spin this as if they “care” about your “privacy”. It is a convenience of the moment to sell more devices like the iPad Pro I’m typing this on. The level of rhetoric has reached foaming-at-the-mouth proportions, and we can no longer have a rational discussion that acknowledges the nuances. Even the word “tracking” is so loaded with evil connotations and indistinguishable in most people’s minds from the ever-cited, rarely existent “selling my personal information” that few can see beyond the word to make a conscious choice about what level of tracking is acceptable. (NONE! I can already hear the shouting.) IDFA is a random identifier that’s been used for attribution and audience targeting (for which Apple provided it). Digital advertising has a fairly unique property, which is that it’s possible (at least sometimes) to connect the dots between “I paid for an ad for my product” and “someone bought the product”. If you’re spending money on advertising and offered the choice between casting it into the void and hoping your sales pick up, versus only paying for successful “conversions”, that second option is going to be pretty attractive. I saw an ad on Facebook for a food delivery service. I signed up and have been enjoying their products and benefitting from fewer grocery trips. I’m ok with that. And I’m ok if there was a little anonymous tag that allowed Facebook to get paid for the service they provided to the company. I’m less ok if they collect information on how much red meat I’m buying and sell it to my insurance company, but that’s not what we’re talking about here and I pretty wound up when people assume that all “tracking” is the same.

jonplackett 6y ago
I disagree. 1) Marketing alone is not why you have an iPad Pro. All other tablets kinda suck compared to it. It's at least 5 years ahead of anything else in hardware and the software is probably further than that. 2) Facebook also not your friend. Corporations can't be friends. 3) Why would anyone _want_ to be tracked if they can avoid it? 4) From a business' POV, sure tracking is useful, but as a consumer, I don't care. I would rather not be tracked - in this instance I think it's nearly even possible to say Apple are being my friend, working for my interests. Also IDFA was introduced as a more private device ID, I doubt they expected it to be exploited this way and are now fixing it. 5) The reason FB cares about this tracking isn't for tracking installs of other apps, it's about their ability (or not) to build up a comprehensive identity of who you, what you do, where you go and what you like, from all the apps and websites you've ever visited.

CWuestefeld 6y ago

I was going to protest what sounded like a silly taunt of "great folks at El Reg". Then I went and read the article. Holy mackerel, compared to this, the folks at Fox and MSNBC are paragons of neutrality. This may be the worst example of journalism I've ever seen. I'm looking all over for something that says "opinion" or "editorial", but no...

dekhn 6y ago
The Register basically emulates british tabloids.
- sroussey 6y ago
  With celebrity nicknames for companies and all!
SllX 6y ago
I was sincere, I love The Register! But there was an actual taunt in that sentence that was much more subtle. Notice what I didn’t say after talking about the “great folks at El Reg”.
srmatto 6y ago
Have you ever read The Register? Its been this way as long as I can remember (1999?). I consider it more of a cheeky, poking-fun style rather than it being inflammatory. They've always created an air of not taking IT/Technology too seriously. Take this job listing for example: https://www.theregister.com/Page/devoops.html https://www.theregister.com/Page/devoops.html 1. DevOops.html 2. Titled: "Vultures seeking penguin-tamer"
- egypturnash 6y ago
  I feel like the fact that The Register has been the Internet home of the Bastard Operator From Hell stories (https://en.wikipedia.org/wiki/Bastard_Operator_From_Hell https://en.wikipedia.org/wiki/Bastard_Operator_From_Hell) since 2000 really sums up its attitude. It is tech news by and for BOFHs.

fencepost 6y ago

And a friendly reminder that if you're on iOS you can go into Settings, search for "advert" and limit ad tracking if you managed to miss that setting before.

autisticcurio 6y ago

Well Facebook make their money from advertising, marketing is advertising so it seems like Apple are taking cues from some laws and customer demand. https://www.gov.uk/marketing-advertising-law/direct-marketing https://www.gov.uk/marketing-advertising-law/direct-marketin...