14 ms·

Apple hits back at European activist complaints against tracking tool

169 points by quyleanh 6y ago

skummetmaelk 6y ago
> Apple said in response that it “does not access or use the IDFA on a user’s device for any purpose”. What is it there for then? If Apple doesn't access the IDFA, but provide the mechanism to do so for others, then clearly Apple is still violating the law. Apple put the IDFA there. Others accessing it is similar to one website giving you a cookie without consent and other websites looking at that cookie. It's still a violation by the website that gave you the cookie without obtaining your consent.
- arethuza 6y ago
  Is there any information on how the IDFA value is accessible?
  - ChrisMarshallNY 6y ago
    Maybe this will help? https://developer.apple.com/app-store/user-privacy-and-data-use/ https://developer.apple.com/app-store/user-privacy-and-data-... There’s a fair bit of documentation about IDFAs (disclaimer: I have never used them, so my experience is limited). Do a search for “IDFA”.
    - dash2 6y ago
      This seems to be a useful starting point: https://developer.apple.com/documentation/adsupport https://developer.apple.com/documentation/adsupport
      - ChrisMarshallNY 6y ago
        Good show! That's probably better.
        arethuza 6y ago
        I was actually curious if it is accessible from Web apps - as far as I can tell the answer is no. [NB Mainly because I do a lot browsing from my Apple devices - not because I want to use it!]
        Maarten88 6y ago
        There are third party Ad-Tech companies that will sell IDFA - cookie combinations they have gathered from their "partners". Think it through: you read this very article, and many cookies on that page you will have consented to will let many ad-tech companies know that you should probably be labeled "privacy conscious". Which, as any good AI will teach them, is closely related to the "extremist left" and "anti fascist" labels. Next, you start Youtube or Insta on your Apple device. Now you suddenly see promoted content from those bubbles because you probably want to click on it. Ad-tech is dangerous.
- donkeyd 6y ago
  > but provide the mechanism to do so for others, then clearly Apple is still violating the law. Apple is severely limiting IDFA in the new iOS and shows a popup asking whether you want to allow apps to track you. So that's become opt-in. https://mobiledevmemo.com/mobile-advertising-without-the-idfa-a-comprehensive-overview/ https://mobiledevmemo.com/mobile-advertising-without-the-idf...
  - Nextgrid 6y ago
    As far as I know they delayed this change.
    - donkeyd 6y ago
      Looked it up, that is correct. Under pressure from Facebook.
      - zepto 6y ago
        Pressure from Facebook where the threat is an antitrust campaign against Apple for abusing their position. I’d argue that a ruling from the EU aids Apple in moving in a direction they already want to go. What I’m sure Apple is opposed to is the implication that they are somehow violating GDPR themselves.
  - SiempreViernes 6y ago
    It's good that they change it, but changing something like that makes it hard to seriously argue that everything is fine now.
    - donkeyd 6y ago
      I never argued that it's fine. I merely responded to the other person to provide some context.
    - user-the-name 6y ago
      Apple clearly agrees that things could be better, which is why they are changing it for the better. However, they can also, without contradiction, argue that they were not acting ILLEGALLY before.
- qwertox 6y ago
  > If Apple doesn't access the IDFA, but provide the mechanism to do so for others, then clearly Apple is still violating the law. I'd disagree with that. It's like blaming the browser for storing the cookie which Facebook uses to track users across websites. If Apple would use the IDFA in their own products, then it would be a different story.
  - Nextgrid 6y ago
    The difference is that browser cookies are necessary for sessions and persisting state - Facebook exploiting this for nefarious purposes isn't the browser's fault. IDFA's only purpose is tracking. I can't see any legitimate use for it. In this case Apple intentionally created a feature (which most people aren't even aware of) that only has malicious use-cases.
    - deleted 6y ago
      [deleted]
    - pmontra 6y ago
      They are convenient. Before cookies we used a session id in the URL and storage on the server.
    - user-the-name 6y ago
      The IDFA is intentionally limited to prevent many malicious use cases. For instance, each vendor will see a different IDFA for the same device, so you can not collect IDFAs to track users across applications. It is for tracking, but not all tracking is malicious. It is used for things like attributing an ad impression to an app install, to measure how effective an ad campaign is at getting people to install an app. This information doesn't really tell you anything about individual users, but is still useful when aggregated.
      - realusername 6y ago
        Why not just scrap the IDFA and let the app save themselves a random uuid in their sqlite database then? Am I missing something?
- smarx007 6y ago
  I think what Apple is saying is that it's not the browser's job to ask consent for storing a cookie or for doing browser fingerprinting but a website's. As much as I dislike IDFA, I think I must agree with their line of reasoning. Edit: Let me bring an analogy (GDPR applies to physical world too). Most cars have a visible VIN number like a phone has an IMEI (if you replace IDFA with IMEI mentally, which would be much worse if that was exposed to the apps). If you take a photo of the VIN and then track the car using this identifier in some way, you are [potentially] violating GDPR, not the car manufacturer.
  - _the_inflator 6y ago
    Totally agree. This is why you don't shut down postal service, just because they could be (mis-)used to deliver drugs or parcel bombs.
    - intricatedetail 6y ago
      But you should close it if they made it easy for that purpose.
      - smarx007 6y ago
        I think NOYB can make a good case for nuking apps that fail to ask for consent completely off the App Store if requested by any protection agency.
      - appleflaxen 6y ago
        how much easier could it possibly be to use it for that purpose?
        kevsim 6y ago
        Special discounts?
        krageon 6y ago
        Perhaps they actively subvert the ways in which those bombs are otherwise detected or they start offering blind pickup so everyone has plausible deniability. There are many ways in which a bomb delivery service could be more convenient than the post.
- tempodox 6y ago
  The IDFA replaces the former use of a device ID that is unchangeable, but you can generate a new IDFA any time in Settings.
  - chinathrow 6y ago
    > but you can generate a new IDFA any time in Settings What like 0.00001% of users would do. That option is useless in practice.
    - user-the-name 6y ago
      Apple is changing it to be opt-in starting 2021. You will be asked any time an app wants to access it.
  - winded_italics 6y ago
    AFAICT this is no longer possible in iOS 14.
- ogre_codes 6y ago
  > What is it there for then? Prior to IDFA, advertisers used other unique on-device information (I believe they had access to the IMEA which was not changeable). With IDFA, users have the option of opting out or at one point resetting the IDFA on the device. IDFA was fundamentally put in to give uses more control. It wasn't really enough, but it was an improvement over what was before it. Now Apple is improving it again by making it opt-in instead of opt-out.
fxtentacle 6y ago
Oh wow, it's the same guy who won in court against Facebook. I can understand why Apple feels the need to quickly shoot back. He's pursuing Apple under German law, and Apple's statement was that they fully follow EU law. So they may both be right at the same time. In detail, Apple is creating a device-unique ID for advertisement tracking and access to that will be user-controlled in iOS 14. And Schrems is filing because it is exposed to advertisers without the user's consent in iOS 13 and earlier.
- user-the-name 6y ago
  It has always been user-controlled, but it was previously opt-out, while the change will make it opt-in.
  - intricatedetail 6y ago
    It's not user controlled if it is on by default.
    - pelasaco 6y ago
      if the user can opt-out, how it isn't user controlled? default passwords, that can be changed, aren't under the user control?
      - xxs 6y ago
        GDPR effectively prohibits ANY opt-out. A an informed consent via affirmative action must be freely given. Apple is so much in the wrong here.
        nojito 6y ago
        >GDPR effectively prohibits ANY opt-out. This isn't true. I don't understand how people continue to make GDPR into this grandiose thing that does everything under the sun.
tobr 6y ago
So Apple’s position is that there’s no problem with the way it works in iOS 13, but they’re changing it in iOS 14 because…?
- octoberfranklin 6y ago
  Because security. Stop thinking so hard, consumer. Shouldn't you be watching football or shopping or something?
- user-the-name 6y ago
  They are arguing it was not ILLEGAL in iOS 13, but they are changing it now to increase user privacy, even though they are not legally required to do so.
donkeyd 6y ago
> The Californian tech giant said in September it would delay plans to launch iOS 14 until early next year. iOS 14 was released in September. What a strange sentence, it's completely incorrect.
- user-the-name 6y ago
  The situation is slightly confusing: The change to IDFA handling was meant to roll out as part of the iOS 14 update. However, the change was delayed, but the rest of iOS 14 was not.
- qubex 6y ago
  As my fellow responder indicted, iOS14 was indeed released in September and I came here to comment on this extremely odd and incorrect statement myself. As the OP states, Apple merely postponed the IDFA functionality. I cannot prove it, but this whole piece reeks of being algorithmically generated, and I do believe that this factual error is proof of that. Any human journalist operating in the field of technology would be well aware that iOS14 has already been released and would have phrased accordingly; I think that what we’re seeing here is some algorithmic synthesis of background facts (one of which was apparently source of confusion, because of references to iOS14 and postponement, not of the whole OS but of a relevant portion thereof).
- floydnoel 6y ago
  Indeed! The article doesn't even link to Apple's statement, which makes me feel as though the writer is cherry-picking here.
  - ffpip 6y ago
    The IDFA opt in requirement was not added to stable release of iOS14
quyleanh 6y ago
I have feeling about Apple wants to keep the user data for their own. With recently privacy issues about macOS and iOS, it sounds like they protect user from 3rd party but the real purpose seems to be they want to control user and user's data.
- user-the-name 6y ago
  They do not collect it themselves either. The "recent privacy issues" did not involve Apple collecting any user information.
  - intricatedetail 6y ago
    Why are you lying? Do you work for Apple?
    - dang 6y ago
      This comment breaks several of the site guidelines. Please read them and stick to the rules when posting here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - turbinerneiter 6y ago
    So they say.
    - user-the-name 6y ago
      And there is zero evidence to the contrary.
- sjwright 6y ago
  You say that like it's a bad thing. Apple is a company many of us have voluntarily chosen to enter a commercial relationship with in a reasonably clear, traditional manner—whereby I give Apple money in exchange for goods and services. Apple aren't making money from my data behind my back. Apple have never stood accused of surreptitiously weaponising my own data against me. They are not collecting my data in order to target me with manipulative advertising or tailor algorithms to maximise engagement.
woahAcademia 6y ago
"Privacy" is just a marketing word for low information consumers. Those that need privacy won't use Apple. Edit- What's wrong? Serious privacy users are going to use an obscure Linux distro. Don't believe the Apple "security theatre", it only puts you at risk.
- eeZah7Ux 6y ago
  > Those that need privacy Everybody needs privacy.
  - fsflover 6y ago
    But not everybody understands it.
- 90red 6y ago
  While it's true that people who need privacy don't typically use closed source software that spies like OSX, but it really shouldn't have to be this way. We are paying extremely high prices for Apple hardware and I'll be damned if I can't get the most privacy oriented experience possible from it.
  - woahAcademia 6y ago
    Just because there are high prices doesn't mean you have any expectations. Do not confuse marketing with the actual service delivered.
sradman 6y ago
From the Wikipedia article on cookies [1]: > Apple uses a tracking technique called "identifier for advertisers" (IDFA). This technique assigns a unique identifier to every user who buys an Apple iOS device (such as an iPhone or iPad). This identifier is then used by Apple's advertising network, iAd, to determine the ads that individuals are viewing and responding to. See Apple Advertising & Privacy [2] for details: > To see this information on your iOS or iPadOS device, go to Settings > Privacy > Apple Advertising and tap View Ad Targeting Information. On Mac, go to System Preferences > Security & Privacy > Privacy, select Apple Advertising, then click View Ad Information. [1] https://en.wikipedia.org/wiki/HTTP_cookie#Identifier_for_advertisers https://en.wikipedia.org/wiki/HTTP_cookie#Identifier_for_adv... [2] https://support.apple.com/en-us/HT205223 https://support.apple.com/en-us/HT205223
intricatedetail 6y ago
"Peeping Tim", Apple that is, has a nerve. The mass surveillance should be investigated.
Maarten88 6y ago
I try to read this very article, and get presented with one of these "Ad-Choices" screens that is completely messed up. You cannot bypass it without consenting, it just won't close if you click "save preferences" without agreeing to things that seem to not be lawful with GDPR. They seem to think that there is somehow a "legitimate interest" for unnamed third parties to "Create a personalised ads profile" (and many more things) when I read an article on their website. These "ad choices" screens conflate the legalese beyond recognition to make you give in to unlawful demands, which is their real purpose. And undoubtedly my Apple advertising ID gets passed to these unnamed third parties in the process. It needs to stop. And I don't care that companies might not be able to exist without it. Good riddance. Good luck Max Schrems fighting this, and please add all these web publishers with their "Ad Choices" scam to your target list.
- sjwright 6y ago
  This matter concerns tracking within iOS apps. Apple has nothing to do with the "Ad Choices" program or anything else to do with website advertising.
  - Maarten88 6y ago
    A quick google on this topic leads me to this ad-tech company: https://help.amplitude.com/hc/en-us/articles/115003135607-Tracking-Unique-Users https://help.amplitude.com/hc/en-us/articles/115003135607-Tr... I do not know this company, Amplitude, and never consciously gave them permission to use my Apple IDFA or combine it with my browser cookies, yet I don't doubt they have an accurate combination of those about me and sell it to any client who can afford it. And that is what this article is about: Apple is enabling this at the source. There are undoubtedly many more Ad-tech companies who market data they gathered about me without freely given consent. Again, it needs to stop.
    - sjwright 6y ago
      I don't see any reference here to IDFA being combined with browser cookies? It's worth noting that Apple has already chosen to kill off IDFA (something that was created as a transition away from developers having to the device's raw UDID) and Apple took this step without needing to be pressured by consumer rights groups.
A_No_Name_Mouse 6y ago
"Hits back"? They just state they don't agree without giving any reasoning.
coldcode 6y ago
The problem is people want "total privacy" but also want everything free. Advertising pays for the latter but people decry both. IDFA is there for advertisers to use without being able to explicitly identify the user but still provide some measure of knowledge to present ads more than random. Once it's no longer opt out, I doubt anyone turns it on. Eventually everything on the web will require payment without there being a universally supported payment method, which is what should be the solution everyone is working on (read an article, pay 1¢ out of a fund you provide under your control for example). But instead we get ranting about privacy. Shouldn't HN discussions be about finding a better way rather than ranting? My programming blog used to get 300,000 readers a year, which would have netted me $3K a year at 1¢. I had too much work and gave had to give it up a couple years ago.
- mosselman 6y ago
  I hardly call the €800 I paid for my phone 'free'. I should not be tracked at that price.
  - user-the-name 6y ago
    Apple does not track you. You can pay your €800 and not be tracked. It is when you choose to install apps by third parties that the IDFA may be used. The IDFA is also specifically designed so that it can not be used to track you across apps and sites, but only for limited cases by one vendor.
    - WesolyKubeczek 6y ago
      The property owner does not track you. You can pay your $2000/month and not be tracked. It is when you choose to have a pizza delivered to you, or a package sent to you by third parties that hidden cameras overlooking your bed, your kitchen, and your toilet, may be used. The camera is also specifically designed so that it cannot be used to track you across other buildings, but only for limited cases by one vendor.
- croon 6y ago
  > The problem is people want "total privacy" but also want everything free. Advertising pays for the latter but people decry both. IDFA is there for advertisers to use without being able to explicitly identify the user but still provide some measure of knowledge to present ads more than random. Once it's no longer opt out, I doubt anyone turns it on. Do advertisers pay Apple for the use of IDFA? Do I pay Apple for the phone? You are saying people should pay for stuff OR get their data sold. Where can I get my free iPhone?
Angostura 6y ago
> The Californian tech giant said in September it would delay plans to launch iOS 14 until early next year. What, what? Does the article mesn the enhanced no-tracking functionality in Safari has been delayed?
xalava 6y ago
The title is at best misleading. They do not attack M. Schrems in Justice or even morally. They are the object of two complaints and they defend themselves invoking that privacy laws are not applicable as they are not directly processing data. This seems a perfectly valid argument. I'd be curious to understand in details their role in the process and see how courts will treat it. Beyond privacy laws, there might be also allegation of fraud as their marketing campaigns seem to relies heavily on privacy and they seem to have a curious conception of it.
Someone 6y ago
s/hits back at/replies to/ In this article, I see nothing that indicates hitting. They don’t even say the complaint is completely unjustified, just that it is inaccurate. That already is the case if only a small detail (for example if it says Apple uses the identifier, while they don’t) in the complaint to be incorrect. It doesn’t make the entire complaint invalid, though. Reading https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:HTML https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX..., article 5.3: “3. Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller.” I would guess (one of) their arguments are that the ID in itself isn’t information and that it is up to those reading the ID to explain the purpose of processing the ID. I think that makes sense, but also can be called factually inaccurate/incomplete. One could argue they collude with advertisers to track you.
newbie578 6y ago
I still prefer getting an ad about a video course I can buy than a random spam video about a mobile game I will never download. Advertisements keep the internet going, if anyone has a different business model then please say it, because people right now are not willing to pay for news, social media or YouTube.
- mikro2nd 6y ago
  It is not my (the "consumer's") responsibility to invent a viable business model for news/social media/video. That is their problem. If the only thing they can come up with is advertising, I, for one, am quite happy to let them die and will continue blocking any and all ads I can possibly block.
- hedora 6y ago
  Using display ads instead of targeted ads would solve the privacy problem, and is still a viable business model. Because ads would be targeted at apps or publishers, not users, premium content would control the premium ad space. This would be good for content creators, consumers, and high quality sites / development houses. It would be bad for ad auction houses, but they don’t provide nearly as much societal value as the newspapers and magazines they replaced.
  - chillacy 6y ago
    This is how podcasts work today at least, the ads are targeted towards interests based on the audience of the podcaster. I don’t know how effective this is though.
martimarkov 6y ago
Sorry for the rant but: When are we going to stop post stuff from reuters.com? For ages their GDPR pop up didn’t work. They have a lot of click bait articles without any real content. This line is an example. It could have been like 1 paragraph. They make inaccurate statements: > The Californian tech giant said in September it would delay plans to launch iOS 14 until early next year. No they said they will launch the feature later, not the OS. //rant over
ogre_codes 6y ago
Here in the US, Apple is fielding anti-trust accusations about removing this. In the EU they are facing privacy concerns over leaving it in. I'm with the EU mostly on this one. Though I do think it's silly for them to pursue Apple at this point when they are already pushing to improve this.

169 points by quyleanh 6y ago

> Apple said in response that it “does not access or use the IDFA on a user’s device for any purpose”. What is it there for then? If Apple doesn't access the IDFA, but provide the mechanism to do so for others, then clearly Apple is still violating the law. Apple put the IDFA there. Others accessing it is similar to one website giving you a cookie without consent and other websites looking at that cookie. It's still a violation by the website that gave you the cookie without obtaining your consent.

arethuza 6y ago
Is there any information on how the IDFA value is accessible?
- ChrisMarshallNY 6y ago
  Maybe this will help? https://developer.apple.com/app-store/user-privacy-and-data-use/ https://developer.apple.com/app-store/user-privacy-and-data-... There’s a fair bit of documentation about IDFAs (disclaimer: I have never used them, so my experience is limited). Do a search for “IDFA”.
  - dash2 6y ago
    This seems to be a useful starting point: https://developer.apple.com/documentation/adsupport https://developer.apple.com/documentation/adsupport
    - ChrisMarshallNY 6y ago
      Good show! That's probably better.
      - arethuza 6y ago
        I was actually curious if it is accessible from Web apps - as far as I can tell the answer is no. [NB Mainly because I do a lot browsing from my Apple devices - not because I want to use it!]
        Maarten88 6y ago
        There are third party Ad-Tech companies that will sell IDFA - cookie combinations they have gathered from their "partners". Think it through: you read this very article, and many cookies on that page you will have consented to will let many ad-tech companies know that you should probably be labeled "privacy conscious". Which, as any good AI will teach them, is closely related to the "extremist left" and "anti fascist" labels. Next, you start Youtube or Insta on your Apple device. Now you suddenly see promoted content from those bubbles because you probably want to click on it. Ad-tech is dangerous.
donkeyd 6y ago
> but provide the mechanism to do so for others, then clearly Apple is still violating the law. Apple is severely limiting IDFA in the new iOS and shows a popup asking whether you want to allow apps to track you. So that's become opt-in. https://mobiledevmemo.com/mobile-advertising-without-the-idfa-a-comprehensive-overview/ https://mobiledevmemo.com/mobile-advertising-without-the-idf...
- Nextgrid 6y ago
  As far as I know they delayed this change.
  - donkeyd 6y ago
    Looked it up, that is correct. Under pressure from Facebook.
    - zepto 6y ago
      Pressure from Facebook where the threat is an antitrust campaign against Apple for abusing their position. I’d argue that a ruling from the EU aids Apple in moving in a direction they already want to go. What I’m sure Apple is opposed to is the implication that they are somehow violating GDPR themselves.
- SiempreViernes 6y ago
  It's good that they change it, but changing something like that makes it hard to seriously argue that everything is fine now.
  - donkeyd 6y ago
    I never argued that it's fine. I merely responded to the other person to provide some context.
  - user-the-name 6y ago
    Apple clearly agrees that things could be better, which is why they are changing it for the better. However, they can also, without contradiction, argue that they were not acting ILLEGALLY before.
qwertox 6y ago
> If Apple doesn't access the IDFA, but provide the mechanism to do so for others, then clearly Apple is still violating the law. I'd disagree with that. It's like blaming the browser for storing the cookie which Facebook uses to track users across websites. If Apple would use the IDFA in their own products, then it would be a different story.
- Nextgrid 6y ago
  The difference is that browser cookies are necessary for sessions and persisting state - Facebook exploiting this for nefarious purposes isn't the browser's fault. IDFA's only purpose is tracking. I can't see any legitimate use for it. In this case Apple intentionally created a feature (which most people aren't even aware of) that only has malicious use-cases.
  - deleted 6y ago
    [deleted]
  - pmontra 6y ago
    They are convenient. Before cookies we used a session id in the URL and storage on the server.
  - user-the-name 6y ago
    The IDFA is intentionally limited to prevent many malicious use cases. For instance, each vendor will see a different IDFA for the same device, so you can not collect IDFAs to track users across applications. It is for tracking, but not all tracking is malicious. It is used for things like attributing an ad impression to an app install, to measure how effective an ad campaign is at getting people to install an app. This information doesn't really tell you anything about individual users, but is still useful when aggregated.
    - realusername 6y ago
      Why not just scrap the IDFA and let the app save themselves a random uuid in their sqlite database then? Am I missing something?
smarx007 6y ago
I think what Apple is saying is that it's not the browser's job to ask consent for storing a cookie or for doing browser fingerprinting but a website's. As much as I dislike IDFA, I think I must agree with their line of reasoning. Edit: Let me bring an analogy (GDPR applies to physical world too). Most cars have a visible VIN number like a phone has an IMEI (if you replace IDFA with IMEI mentally, which would be much worse if that was exposed to the apps). If you take a photo of the VIN and then track the car using this identifier in some way, you are [potentially] violating GDPR, not the car manufacturer.
- _the_inflator 6y ago
  Totally agree. This is why you don't shut down postal service, just because they could be (mis-)used to deliver drugs or parcel bombs.
  - intricatedetail 6y ago
    But you should close it if they made it easy for that purpose.
    - smarx007 6y ago
      I think NOYB can make a good case for nuking apps that fail to ask for consent completely off the App Store if requested by any protection agency.
    - appleflaxen 6y ago
      how much easier could it possibly be to use it for that purpose?
      - kevsim 6y ago
        Special discounts?
      - krageon 6y ago
        Perhaps they actively subvert the ways in which those bombs are otherwise detected or they start offering blind pickup so everyone has plausible deniability. There are many ways in which a bomb delivery service could be more convenient than the post.
tempodox 6y ago
The IDFA replaces the former use of a device ID that is unchangeable, but you can generate a new IDFA any time in Settings.
- chinathrow 6y ago
  > but you can generate a new IDFA any time in Settings What like 0.00001% of users would do. That option is useless in practice.
  - user-the-name 6y ago
    Apple is changing it to be opt-in starting 2021. You will be asked any time an app wants to access it.
- winded_italics 6y ago
  AFAICT this is no longer possible in iOS 14.
ogre_codes 6y ago
> What is it there for then? Prior to IDFA, advertisers used other unique on-device information (I believe they had access to the IMEA which was not changeable). With IDFA, users have the option of opting out or at one point resetting the IDFA on the device. IDFA was fundamentally put in to give uses more control. It wasn't really enough, but it was an improvement over what was before it. Now Apple is improving it again by making it opt-in instead of opt-out.

fxtentacle 6y ago

Oh wow, it's the same guy who won in court against Facebook. I can understand why Apple feels the need to quickly shoot back. He's pursuing Apple under German law, and Apple's statement was that they fully follow EU law. So they may both be right at the same time. In detail, Apple is creating a device-unique ID for advertisement tracking and access to that will be user-controlled in iOS 14. And Schrems is filing because it is exposed to advertisers without the user's consent in iOS 13 and earlier.

user-the-name 6y ago
It has always been user-controlled, but it was previously opt-out, while the change will make it opt-in.
- intricatedetail 6y ago
  It's not user controlled if it is on by default.
  - pelasaco 6y ago
    if the user can opt-out, how it isn't user controlled? default passwords, that can be changed, aren't under the user control?
    - xxs 6y ago
      GDPR effectively prohibits ANY opt-out. A an informed consent via affirmative action must be freely given. Apple is so much in the wrong here.
      - nojito 6y ago
        >GDPR effectively prohibits ANY opt-out. This isn't true. I don't understand how people continue to make GDPR into this grandiose thing that does everything under the sun.

tobr 6y ago

So Apple’s position is that there’s no problem with the way it works in iOS 13, but they’re changing it in iOS 14 because…?

octoberfranklin 6y ago
Because security. Stop thinking so hard, consumer. Shouldn't you be watching football or shopping or something?
user-the-name 6y ago
They are arguing it was not ILLEGAL in iOS 13, but they are changing it now to increase user privacy, even though they are not legally required to do so.

donkeyd 6y ago

> The Californian tech giant said in September it would delay plans to launch iOS 14 until early next year. iOS 14 was released in September. What a strange sentence, it's completely incorrect.

user-the-name 6y ago
The situation is slightly confusing: The change to IDFA handling was meant to roll out as part of the iOS 14 update. However, the change was delayed, but the rest of iOS 14 was not.
qubex 6y ago
As my fellow responder indicted, iOS14 was indeed released in September and I came here to comment on this extremely odd and incorrect statement myself. As the OP states, Apple merely postponed the IDFA functionality. I cannot prove it, but this whole piece reeks of being algorithmically generated, and I do believe that this factual error is proof of that. Any human journalist operating in the field of technology would be well aware that iOS14 has already been released and would have phrased accordingly; I think that what we’re seeing here is some algorithmic synthesis of background facts (one of which was apparently source of confusion, because of references to iOS14 and postponement, not of the whole OS but of a relevant portion thereof).
floydnoel 6y ago
Indeed! The article doesn't even link to Apple's statement, which makes me feel as though the writer is cherry-picking here.
- ffpip 6y ago
  The IDFA opt in requirement was not added to stable release of iOS14

quyleanh 6y ago

I have feeling about Apple wants to keep the user data for their own. With recently privacy issues about macOS and iOS, it sounds like they protect user from 3rd party but the real purpose seems to be they want to control user and user's data.

user-the-name 6y ago
They do not collect it themselves either. The "recent privacy issues" did not involve Apple collecting any user information.
- intricatedetail 6y ago
  Why are you lying? Do you work for Apple?
  - dang 6y ago
    This comment breaks several of the site guidelines. Please read them and stick to the rules when posting here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- turbinerneiter 6y ago
  So they say.
  - user-the-name 6y ago
    And there is zero evidence to the contrary.
sjwright 6y ago
You say that like it's a bad thing. Apple is a company many of us have voluntarily chosen to enter a commercial relationship with in a reasonably clear, traditional manner—whereby I give Apple money in exchange for goods and services. Apple aren't making money from my data behind my back. Apple have never stood accused of surreptitiously weaponising my own data against me. They are not collecting my data in order to target me with manipulative advertising or tailor algorithms to maximise engagement.

woahAcademia 6y ago

"Privacy" is just a marketing word for low information consumers. Those that need privacy won't use Apple. Edit- What's wrong? Serious privacy users are going to use an obscure Linux distro. Don't believe the Apple "security theatre", it only puts you at risk.

eeZah7Ux 6y ago
> Those that need privacy Everybody needs privacy.
- fsflover 6y ago
  But not everybody understands it.
90red 6y ago
While it's true that people who need privacy don't typically use closed source software that spies like OSX, but it really shouldn't have to be this way. We are paying extremely high prices for Apple hardware and I'll be damned if I can't get the most privacy oriented experience possible from it.
- woahAcademia 6y ago
  Just because there are high prices doesn't mean you have any expectations. Do not confuse marketing with the actual service delivered.

sradman 6y ago

From the Wikipedia article on cookies [1]: > Apple uses a tracking technique called "identifier for advertisers" (IDFA). This technique assigns a unique identifier to every user who buys an Apple iOS device (such as an iPhone or iPad). This identifier is then used by Apple's advertising network, iAd, to determine the ads that individuals are viewing and responding to. See Apple Advertising & Privacy [2] for details: > To see this information on your iOS or iPadOS device, go to Settings > Privacy > Apple Advertising and tap View Ad Targeting Information. On Mac, go to System Preferences > Security & Privacy > Privacy, select Apple Advertising, then click View Ad Information. [1] https://en.wikipedia.org/wiki/HTTP_cookie#Identifier_for_advertisers https://en.wikipedia.org/wiki/HTTP_cookie#Identifier_for_adv... [2] https://support.apple.com/en-us/HT205223 https://support.apple.com/en-us/HT205223

intricatedetail 6y ago

"Peeping Tim", Apple that is, has a nerve. The mass surveillance should be investigated.

Maarten88 6y ago

I try to read this very article, and get presented with one of these "Ad-Choices" screens that is completely messed up. You cannot bypass it without consenting, it just won't close if you click "save preferences" without agreeing to things that seem to not be lawful with GDPR. They seem to think that there is somehow a "legitimate interest" for unnamed third parties to "Create a personalised ads profile" (and many more things) when I read an article on their website. These "ad choices" screens conflate the legalese beyond recognition to make you give in to unlawful demands, which is their real purpose. And undoubtedly my Apple advertising ID gets passed to these unnamed third parties in the process. It needs to stop. And I don't care that companies might not be able to exist without it. Good riddance. Good luck Max Schrems fighting this, and please add all these web publishers with their "Ad Choices" scam to your target list.

sjwright 6y ago
This matter concerns tracking within iOS apps. Apple has nothing to do with the "Ad Choices" program or anything else to do with website advertising.
- Maarten88 6y ago
  A quick google on this topic leads me to this ad-tech company: https://help.amplitude.com/hc/en-us/articles/115003135607-Tracking-Unique-Users https://help.amplitude.com/hc/en-us/articles/115003135607-Tr... I do not know this company, Amplitude, and never consciously gave them permission to use my Apple IDFA or combine it with my browser cookies, yet I don't doubt they have an accurate combination of those about me and sell it to any client who can afford it. And that is what this article is about: Apple is enabling this at the source. There are undoubtedly many more Ad-tech companies who market data they gathered about me without freely given consent. Again, it needs to stop.
  - sjwright 6y ago
    I don't see any reference here to IDFA being combined with browser cookies? It's worth noting that Apple has already chosen to kill off IDFA (something that was created as a transition away from developers having to the device's raw UDID) and Apple took this step without needing to be pressured by consumer rights groups.

A_No_Name_Mouse 6y ago

"Hits back"? They just state they don't agree without giving any reasoning.

coldcode 6y ago

The problem is people want "total privacy" but also want everything free. Advertising pays for the latter but people decry both. IDFA is there for advertisers to use without being able to explicitly identify the user but still provide some measure of knowledge to present ads more than random. Once it's no longer opt out, I doubt anyone turns it on. Eventually everything on the web will require payment without there being a universally supported payment method, which is what should be the solution everyone is working on (read an article, pay 1¢ out of a fund you provide under your control for example). But instead we get ranting about privacy. Shouldn't HN discussions be about finding a better way rather than ranting? My programming blog used to get 300,000 readers a year, which would have netted me $3K a year at 1¢. I had too much work and gave had to give it up a couple years ago.

mosselman 6y ago
I hardly call the €800 I paid for my phone 'free'. I should not be tracked at that price.
- user-the-name 6y ago
  Apple does not track you. You can pay your €800 and not be tracked. It is when you choose to install apps by third parties that the IDFA may be used. The IDFA is also specifically designed so that it can not be used to track you across apps and sites, but only for limited cases by one vendor.
  - WesolyKubeczek 6y ago
    The property owner does not track you. You can pay your $2000/month and not be tracked. It is when you choose to have a pizza delivered to you, or a package sent to you by third parties that hidden cameras overlooking your bed, your kitchen, and your toilet, may be used. The camera is also specifically designed so that it cannot be used to track you across other buildings, but only for limited cases by one vendor.
croon 6y ago
> The problem is people want "total privacy" but also want everything free. Advertising pays for the latter but people decry both. IDFA is there for advertisers to use without being able to explicitly identify the user but still provide some measure of knowledge to present ads more than random. Once it's no longer opt out, I doubt anyone turns it on. Do advertisers pay Apple for the use of IDFA? Do I pay Apple for the phone? You are saying people should pay for stuff OR get their data sold. Where can I get my free iPhone?

Angostura 6y ago

> The Californian tech giant said in September it would delay plans to launch iOS 14 until early next year. What, what? Does the article mesn the enhanced no-tracking functionality in Safari has been delayed?

xalava 6y ago

The title is at best misleading. They do not attack M. Schrems in Justice or even morally. They are the object of two complaints and they defend themselves invoking that privacy laws are not applicable as they are not directly processing data. This seems a perfectly valid argument. I'd be curious to understand in details their role in the process and see how courts will treat it. Beyond privacy laws, there might be also allegation of fraud as their marketing campaigns seem to relies heavily on privacy and they seem to have a curious conception of it.

Someone 6y ago

s/hits back at/replies to/ In this article, I see nothing that indicates hitting. They don’t even say the complaint is completely unjustified, just that it is inaccurate. That already is the case if only a small detail (for example if it says Apple uses the identifier, while they don’t) in the complaint to be incorrect. It doesn’t make the entire complaint invalid, though. Reading https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:HTML https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX..., article 5.3: “3. Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller.” I would guess (one of) their arguments are that the ID in itself isn’t information and that it is up to those reading the ID to explain the purpose of processing the ID. I think that makes sense, but also can be called factually inaccurate/incomplete. One could argue they collude with advertisers to track you.

newbie578 6y ago

I still prefer getting an ad about a video course I can buy than a random spam video about a mobile game I will never download. Advertisements keep the internet going, if anyone has a different business model then please say it, because people right now are not willing to pay for news, social media or YouTube.

mikro2nd 6y ago
It is not my (the "consumer's") responsibility to invent a viable business model for news/social media/video. That is their problem. If the only thing they can come up with is advertising, I, for one, am quite happy to let them die and will continue blocking any and all ads I can possibly block.
hedora 6y ago
Using display ads instead of targeted ads would solve the privacy problem, and is still a viable business model. Because ads would be targeted at apps or publishers, not users, premium content would control the premium ad space. This would be good for content creators, consumers, and high quality sites / development houses. It would be bad for ad auction houses, but they don’t provide nearly as much societal value as the newspapers and magazines they replaced.
- chillacy 6y ago
  This is how podcasts work today at least, the ads are targeted towards interests based on the audience of the podcaster. I don’t know how effective this is though.

martimarkov 6y ago

Sorry for the rant but: When are we going to stop post stuff from reuters.com? For ages their GDPR pop up didn’t work. They have a lot of click bait articles without any real content. This line is an example. It could have been like 1 paragraph. They make inaccurate statements: > The Californian tech giant said in September it would delay plans to launch iOS 14 until early next year. No they said they will launch the feature later, not the OS. //rant over

ogre_codes 6y ago

Here in the US, Apple is fielding anti-trust accusations about removing this. In the EU they are facing privacy concerns over leaving it in. I'm with the EU mostly on this one. Though I do think it's silly for them to pursue Apple at this point when they are already pushing to improve this.