3 ms·

I always wondered if that advertising ID is GDPR compliant, given that the setting is currently opt-out, instead of opt-in. Even if it is low entropy.

Nextgrid 6y ago
I don’t think it would be, however the party considered in breach would be the app developers and not Apple. Consent should be opt-in and granular (a user might wish to opt-in for one app but opt-out for another one) so every app should’ve already implemented their own toggle (like iOS 14 would force them to) instead of just using it in the background and pointing users to the system-wide setting if they want to opt-out (which isn’t ideal if the user wants to remain opted-in for some apps only).
- krageon 6y ago
  > the party considered in breach would be the app developers Given that this feature is entirely made by Apple, that's not a reasonable conclusion.
  - wastedhours 6y ago
    Isn't it down to the app developers though whether they allow the ID to be used to serve ads in their app (whether or not in practice there's a mechanism to do that, it's the app developer that's essentially choosing to use it by implementing ad networks and SDKs that use it, not Apple forcing it on them).
  - rsynnott 6y ago
    Your browser (probably) allows the use of cookies; however a website which doesn't ask the user for appropriate permission is still in breach of the law.
  - kergonath 6y ago
    It’s not Apple doing the tracking. The knife manufacturer is not reaponsible if you stab someone.
- bad_user 6y ago
  IANAL. Not sure about that. IDFA is essentially a tracking cookie. First of all under GDPR, tracking can be for a legitimate interest, and thus it might not require opt-in. For example security, or even first-party analytics, with the purpose of optimizing the content, can be legitimate interests. However this cookie is meant for advertising, and user profiling for marketing purposes doesn't pass the test for legitimate interest. The other problem, for Apple, might be the revised E-Privacy Directive. You can't set such tracking cookies without informing users. Such cookies must be opt-in, whether you use them or not. AFAIK Apple is simply complying with the law, whereas Facebook is effectively arguing for unlawful tracking, because that's just who they are.
MilaM 6y ago
My understanding is, that it's a random and unique identifier, and therfore very high entropy. Pooling that data allows FB to identify you in different apps that use the SDK, even if they don't have any other identifying info.

Nextgrid 6y ago

I don’t think it would be, however the party considered in breach would be the app developers and not Apple. Consent should be opt-in and granular (a user might wish to opt-in for one app but opt-out for another one) so every app should’ve already implemented their own toggle (like iOS 14 would force them to) instead of just using it in the background and pointing users to the system-wide setting if they want to opt-out (which isn’t ideal if the user wants to remain opted-in for some apps only).

krageon 6y ago
> the party considered in breach would be the app developers Given that this feature is entirely made by Apple, that's not a reasonable conclusion.
- wastedhours 6y ago
  Isn't it down to the app developers though whether they allow the ID to be used to serve ads in their app (whether or not in practice there's a mechanism to do that, it's the app developer that's essentially choosing to use it by implementing ad networks and SDKs that use it, not Apple forcing it on them).
- rsynnott 6y ago
  Your browser (probably) allows the use of cookies; however a website which doesn't ask the user for appropriate permission is still in breach of the law.
- kergonath 6y ago
  It’s not Apple doing the tracking. The knife manufacturer is not reaponsible if you stab someone.
bad_user 6y ago
IANAL. Not sure about that. IDFA is essentially a tracking cookie. First of all under GDPR, tracking can be for a legitimate interest, and thus it might not require opt-in. For example security, or even first-party analytics, with the purpose of optimizing the content, can be legitimate interests. However this cookie is meant for advertising, and user profiling for marketing purposes doesn't pass the test for legitimate interest. The other problem, for Apple, might be the revised E-Privacy Directive. You can't set such tracking cookies without informing users. Such cookies must be opt-in, whether you use them or not. AFAIK Apple is simply complying with the law, whereas Facebook is effectively arguing for unlawful tracking, because that's just who they are.

MilaM 6y ago

My understanding is, that it's a random and unique identifier, and therfore very high entropy. Pooling that data allows FB to identify you in different apps that use the SDK, even if they don't have any other identifying info.