14 ms·

In Europe, cross-app, cross-browser & cross-device tracking is on very thin ice legally under the GDPR, so I'm not surprised Apple finally curbs the use of "sti

In Europe, cross-app, cross-browser & cross-device tracking is on very thin ice legally under the GDPR, so I'm not surprised Apple finally curbs the use of "sticky" identifiers on their devices. Honestly, it's a bit shameful that a device that is marketed as the gold standard in privacy would even support such an identifier in the first place, it has literally no purpose beyond mining peoples' data. Now that the third-party tracking ecosystem is slowly drying out I'm curious what advertisers will come up with to circumvent these new measures. Anyone here that works in the industry and wants to share some plans?

mehrdada 6y ago
I think it started as a compromise measure to hamper down on collection of other more persistent device identifiers (through AppStore regulation) so in a way it was a step in the right direction when introduced.
endymi0n 6y ago
Having been on both sides of the table, I would slightly disagree here. Fraud prevention for example will get an order of magnitude harder, plus this move will further skew the playing field towards FAANG who have the resources to puzzle the scraps back together for decent conversion tracking with the help of logins, IPs, SDKs with First Party IDs and a massive dose of machine learning.
- lotsofpulp 6y ago
  I wonder if it would be profitable for Visa/Mastercard/Discover/AmEx to sell a verification service where people can authenticate with a $0.01 authorization or approval amount. Obviously, it wouldn't work with gift cards or other accounts not tied to a real person.
  - rattray 6y ago
    And make stolen credit card numbers even more valuable? (I like where your head is at, fraud is just hard)
    - sudhirj 6y ago
      Stolen cards have long since been solved in many parts of the world with 3DS. Not sure why the US is still lagging behind on this.
      - trishmapow2 6y ago
        3D Secure for those like me who didn't know the proper term, referring to an extra verification step from your bank e.g. SMS. https://en.wikipedia.org/wiki/3-D_Secure https://en.wikipedia.org/wiki/3-D_Secure https://stripe.com/docs/payments/3d-secure https://stripe.com/docs/payments/3d-secure
      - hanche 6y ago
        For some value of “solved”, yes. I live in 3DS-land myself, but since 3DS is not universal, credit card info is still at risk. I had a fraudulent purchase against my card recently. The bank returned the money, but at the moment, I am fighting a bill for import duty on the Gucci scarf the crook purchased on my card. :-/ I had no idea, until now, that they may charge €350 for a scarf.
    - lotsofpulp 6y ago
      Combine it with 2FA, such as TOTP or SMS.
  - ratherbefuddled 6y ago
    The answer to card fraud is called Strong Customer Authentication and it's a requirement under PSD2. It requires payment service providers to obtain a second factor for authentication. This might be an online banking login and approval, device data capture or an SMS one time code. How is up to the card provider.
    - lotsofpulp 6y ago
      I'm not referring to verification for card fraud, I'm saying the card networks could sell it to anyone that wants to verify a human is on the other end. Like an alternative to Captcha.
      - ratherbefuddled 6y ago
        Strong Customer Authentication should be sufficient to prove that the payment request is authorised by the card holder, given this I'm not sure why a business would pay to be sure there's a human there?
        lotsofpulp 6y ago
        I’m not referring to payments at all. I’m talking about using the card networks to serve as an alternative to Captcha for things like forums or any other situation besieged by bots and whatnot.
- wil421 6y ago
  Do you think iPhone users care if it’s harder for Facebook and the like to catch fraud?
  - Cipater 6y ago
    I'll flip this one back to you in the same spirit. Do you think iPhone users care that Apple is implementing anti-tracking?
    - CubsFan1060 6y ago
      I do, but mostly as part of the overall message. Folks like my parents will comment about how creepy targeted ads are. When I showed them how to turn it off currently, they were very happy. I don't think they know each setting that is available, but they without doubt have the impression that "Apple is better with privacy"
    - Twisell 6y ago
      Yes we do care Maybe not all of us, but for me it's an important and differentiating feature. What we don't really care about is hypothetical thinking about wether we care from people that apparently don't care.
    - sequoia 6y ago
      They’ll care if Apple tells them to care. Sent from my iPhone
    - wil421 6y ago
      Absolutely and it’s a huge reason I will never use Android. I don’t want an advertising company making my phone.
    - leadingthenet 6y ago
      Yes, it's like half the reason I own Apple devices.
    - coldpie 6y ago
      I've used Android for the past decade, but I'm very strongly considering switching to iPhone because of Apple's pro-privacy moves in iOS over the past year (and also because they are the only manufacturer to make a phone that fits the human hand).
- stefan_ 6y ago
  Fraud prevention? What exactly are you paying the Apple cut for?
  - tenacious_tuna 6y ago
    I think they mean app-side: determining if a user is a bot or not gets harder when you can't tie that user to the datamine'd indicators of their humanity.
    - swiley 6y ago
      Hackernews seems to manage.
      - javajosh 6y ago
        We don't move money around or even have private messaging. If the stakes are high enough, users need the service provider to be skeptical of all client processes, because the risk of being impersonated is born, right or wrong, by the user.
        swiley 6y ago
        If you move money around then the legal system already exists to deal with fraud. As someone who doesn't use an iphone it's really frustrating that online services are starting to expect one for this reason when it hasn't been necessary in the past.
        tenacious_tuna 6y ago
        There's a cost-benefit balance at play: is using the cost of the legal system (lawyers, evidence, courts, long tail on case times) better than developing a system to prevent fraudulent users? I also wouldn't be surprised if there was a burden of "good faith effort" required to show that you've taken measures to prevent frauds.
        justapassenger 6y ago
- Nextgrid 6y ago
  > FAANG who have the resources to puzzle the scraps back together for decent conversion tracking with the help of logins, IPs, SDKs with First Party IDs Those are not exempt from the GDPR either. Granted, at the moment there’s very little enforcement around these (especially IP addresses despite their huge tracking potential) but once enforcement is stepped up there shouldn’t be any difference whether it’s a FAANG or a small company doing it).
  - deleted 6y ago
    [deleted]
- eznzt 6y ago
  I don't know why you use a big word such as "fraud" when you mean "we want to be able to know which accounts are owned by the same person".
  - jefftk 6y ago
    That isn't what "fraud" means in this context. Ad fraud is when you have something other than a real user loading or clicking on ads. For example, I could stand up a headless browser to click on the ads on my site. This would get me more of a payout from my advertisers, but would also be fraud. A stable identifier makes identifying this sort of behavior much easier. (Disclosure: I work on ads at Google, speaking only for myself)
    - rndgermandude 6y ago
      Ad fraud... How exactly is this my problem as a consumer? This sounds pretty much like a "you" (ad networks and advertisers) problem... So why should you be allowed to spy on me - who never defrauded any advertisers - to fix your problem?
      - jforman 6y ago
        Because it makes advertising more expensive, which in turn makes the products and services you use more expensive.
        alisonkisk 6y ago
        How is that my problem? I have no interest in advertising more assaulting me with lies.
        deleted 6y ago
        [deleted]
        coldpie 6y ago
        I would be thrilled if online advertising became unviable as a business model. Most of what makes the web suck today (megabytes of javascript on every page; clickbait articles; outrage-driven social media; warehouses of PII waiting to be bought/sold/stolen) is because of advertising. Yes, I do want to pay for the services I use.
- gnu8 6y ago
  > puzzle the scraps back together They’re not supposed to do that. Their dogmatic refusal to see the writing on the wall is ridiculous.
- chokeartist 6y ago
  I'm calling your bluff right now: online advertising, which is underpinned on knowing as much as possible about you, is fucked. The half measures you described will not even be 10% as useful as the current model (direct ID from the device). What are you going to correlate a CG-NAT IP with, when said IP is shared by potentially hundreds of thousands of users? It becomes an exercise of diminishing returns, very quickly. And that is not a defect, that's a feature. Privacy isn't about just maximizing your shekels. It is about protecting and respecting user data. Advertisers are clinically incapable of understanding that second part.
- csommers 6y ago
  “Fraud”...uh-huh. Please be clear that you mean AD fraud and not fraud-fraud. Also: boohoo
- ogre_codes 6y ago
  > Fraud prevention for example will get an order of magnitude harder, First Ad Fraud != Fraud. It is low grade hacking. Second. Trading the privacy of every iPhone user so that advertisers can prop up a sketchy/ poor industry is a terrible trade.
  - closeparen 6y ago
    This completely changes the game on all kinds of fraud, not just ad fraud. Currently when you get caught, the service you’re abusing bans your device. To keep trying you need new hardware; attacks have a real monetary cost for the attacker. When your iPhone can present itself as infinitely many iPhones, this is neutered, and services will need different (probably more invasive) techniques to keep banned users away.
    - omgwtfbyobbq 6y ago
      Can someone (only) use IMEI plus account instead of IDFA for uniqueness? So if you want to exclude/ban a user, you can use the IMEI+account, but outside of excluding a user from using your service, you cannot access IMEI+account. User privacy is preserved because there's no singular ID for advertisers, and services can still ban fraud because if it's present they can use the IMEI+account to ban a user. Maybe even have that built into the OS? The app can ban someone based on an IMEI+account, but the IMEI+account info stays on the device. The device just certifies that the combination is unique without exposing that info to the app, and the app can still ban that hardware/account, so the user would need to buy new hardware to get around the ban.
      - ogre_codes 6y ago
        The IMEA is worse than the IDFA and neither is needed for this use case.
        omgwtfbyobbq 6y ago
        It could be. In that case, let the OS handle whether the phone/account are unique, and the app can ban that phone/account without having that unique identifier to ID the person in other cases, like advertising.
- _the_inflator 6y ago
  I agree here. Apple's privacy changes might seem like a good idea from the outside, but essentially or paradoxically leads to higher entry barriers for new competitors and cement the role the actual players have. However, we do not have experience with so-called "big tech." It is relatively new, iPhone came to light in 2007. So I regard Apple's measurements as another experiment, and we will see how things further evolve.
  - adamlett 6y ago
    Apple's privacy changes might seem like a good idea from the outside, but essentially or paradoxically leads to higher entry barriers for new competitors and cement the role the actual players have. Honestly, who cares if the barrier of entry for a shitty business model is raised. And can see only upside to this.
  - kergonath 6y ago
    I won’t complain if it makes it harder for fly-by-night ad brokers to set up shop, quite the contrary. I don’t care if the playing field is not level, and we don’t owe them a business. You’re right, things are moving quite fast, but we are also more and more vulnerable. I won’t hesitate between the human right to privacy and a company’s right to make money.
- layoutIfNeeded 6y ago
  “Fraudsters” can already reset the IDFA from the iOS Settings by turning off personalized ads in the Privacy section.
rpastuszak 6y ago
- fingerprinting (especially if you don't own any premium inventory, as premium publishers generally dislike 3p targeting). - contextual (target the content, make decisions based on _what I'm reading_ now, not who _I am_--less dubious ethically) My favourite one: behavioural rebranded as contextual (I know some companies selling "contextual targeting", where some of the properties clearly define the user, these are mostly ML-based solutions, relying on mobile hardware) Behavioural cross-platform targeting will exist but in a less deterministic form. source: I used to work in AdTech and started a bunch of privacy-related initiatives.
olliej 6y ago
The purpose of IDFA was to provide an identifier that wasn't hardwired to the device - apps were going to absurd lengths to get the UDID, and IDFA gave them something ostensibly sufficient that users could in theory reset at will. I give good odds ad frameworks will again start trying to circumvent the platform security to get a UDID or equivalent.
- ogre_codes 6y ago
  Then apps get kicked out of the App Store for violating App Store Policy and word gets around that it's a shitty ad network.
  - deleted 6y ago
    [deleted]
- andrekandre 6y ago
  if i remember correctly they (apple) still dont block access to the devices name (e.g "Johns iPad Pro"), so thats also one easy way to fingerprint* even without idfa * to say nothing about the fact that apps can easily get my first name without me knowing it being super creepy
littlestymaar 6y ago
> shameful that a device that is marketed as the gold standard in privacy It's being marketed this way, that's it. It doesn't mean Apple care about privacy, and they prove every once in a while that they don't respect anyone's privacy at all. They spy on their users as much as anyone else (and overall, they have access to much more information than everybody else except Google). All they want to do is prevent third-party tracking on their devices, so they have a monopoly on their users' data. But they do collect those data and they share them with third party “partners”. Don't trust me, just look at their privacy policy, it's explicitly written there: https://www.apple.com/legal/privacy/en-ww/ https://www.apple.com/legal/privacy/en-ww/
- objclxt 6y ago
  > They spy on their users as much as anyone else (and overall, they have access to much more information than everybody else except Google). This is easily disproven by making a GDPR access request to see what various companies have retained on you, or if you’re extra paranoid inspecting what the device is sending back over the network.
  - littlestymaar 6y ago
    Well, less than a month ago all Mac apps worldwide refused to open because the listening service at Apple failed to respond, so you don't even have to look at the network to know that Apple is spying… Apple has access to all apps you open, your position, the content of your iCloud, etc. etc.
    - avianlyric 6y ago
      Yeah you might want to do a little more research on that topic as you clearly have no idea what your talking about. Incidentally did you know that web browsers tell certificate authorities about every website you visit that uses TLS with support for OCSP stapling.
      - account42 6y ago
eivarv 6y ago
Now that the third-party tracking ecosystem is slowly drying out I'm curious what advertisers will come up with to circumvent these new measures. Probably fingerprinting – not to mention the fact that ad-people are lobbying both legislators (including the EU) and standards bodies (like W3C)... and in the latter case they're also directly contributing to the standards.
- cafebabbe 6y ago
  Most adtech players are legit and don't rely on such practices, illegal in many countries. Of course some smaller one will still try to do it, don't get me wrong.
  - eivarv 6y ago
    Well, there's the entire field of databroking (likely completely illegal under GDPR, not to mention unethical from the start) and real time bidding related to this. Given the sorry state of privacy-compliance in general (whether that's ignorance of the law or consciously taking a risk) I seriously doubt that the field of adtech is much better.
sradman 6y ago
> it has literally no purpose beyond mining peoples' data Its main purpose is targeted ads while repurposing or reselling peoples’ data is a nefarious secondary use. Multi-sided markets are important revenue models that are tailored to user preferences and behavior. We are trying to strike a balance; we don’t need to demonize all advertising centric business models to win the argument for better privacy options. I think both Apple and Mozilla are more aligned with my personal preferences but their positions are also perfectly aligned with their core business models.
- suprfsat 6y ago
  How do you propose to target ads without mining peoples' data?
  - thrwn_frthr_awy 6y ago
    If companies can’t target ads without data mining that isn’t an argument for data mining—it’s an argument against targeted ads.
  - Bockit 6y ago
    Essentially, you don’t.
  - jefftk 6y ago
    One of the most common cases of targeting ads is remarketing: someone comes to your site, they start the process of buying a tablesaw but then leave for whatever reason. You pay to show ads of the saw so they can come back and finish their purchase if they want to. Traditionally, this has been implemented with third party cookies. The retailer drops a cookie on the users browser, and then buys ads to be shown to anyone matching that cookie. I don't know if I would call this data mining, but it is certainly not private. It is possible to build a system that supports remarketing in a private way, however, with new browser APIs: https://github.com/WICG/turtledove https://github.com/WICG/turtledove (Disclosure: I work on ads at Google, speaking only for myself)
    - 6y ago
tmakks 6y ago
> cross-device tracking is on very thin ice legally under the GDPR Exactly and tracking companies such as Adjust or AppsFlyer carry on IFDA-ing/fingerprinting users. GDPR seems to be just a nice-to-have.
doomslice 6y ago
https://www.thetradedesk.com/industry-initiatives/unified-id-solution https://www.thetradedesk.com/industry-initiatives/unified-id... https://www.verizonmedia.com/insights/overcoming-identity-headwinds-connectid https://www.verizonmedia.com/insights/overcoming-identity-he... And probably a dozen other ID solutions out there that require you to be logged in and thus have some first party data to match you with. Honestly I'm not sure what the value proposition is for the user if it's not required to log in, so who knows what the uptake will be.
pwinnski 6y ago
Things have changed really dramatically in in the last 13 years or so. When iPhone first launched, developers could (and did) just grab the UDID of the device and use that. Apple has been restricting things almost from day one, and creating the IDFA in the first place was part of that, but this seems like the biggest step forward by far.

mehrdada 6y ago

I think it started as a compromise measure to hamper down on collection of other more persistent device identifiers (through AppStore regulation) so in a way it was a step in the right direction when introduced.

endymi0n 6y ago

Having been on both sides of the table, I would slightly disagree here. Fraud prevention for example will get an order of magnitude harder, plus this move will further skew the playing field towards FAANG who have the resources to puzzle the scraps back together for decent conversion tracking with the help of logins, IPs, SDKs with First Party IDs and a massive dose of machine learning.

lotsofpulp 6y ago
I wonder if it would be profitable for Visa/Mastercard/Discover/AmEx to sell a verification service where people can authenticate with a $0.01 authorization or approval amount. Obviously, it wouldn't work with gift cards or other accounts not tied to a real person.
- rattray 6y ago
  And make stolen credit card numbers even more valuable? (I like where your head is at, fraud is just hard)
  - sudhirj 6y ago
    Stolen cards have long since been solved in many parts of the world with 3DS. Not sure why the US is still lagging behind on this.
    - trishmapow2 6y ago
      3D Secure for those like me who didn't know the proper term, referring to an extra verification step from your bank e.g. SMS. https://en.wikipedia.org/wiki/3-D_Secure https://en.wikipedia.org/wiki/3-D_Secure https://stripe.com/docs/payments/3d-secure https://stripe.com/docs/payments/3d-secure
    - hanche 6y ago
      For some value of “solved”, yes. I live in 3DS-land myself, but since 3DS is not universal, credit card info is still at risk. I had a fraudulent purchase against my card recently. The bank returned the money, but at the moment, I am fighting a bill for import duty on the Gucci scarf the crook purchased on my card. :-/ I had no idea, until now, that they may charge €350 for a scarf.
  - lotsofpulp 6y ago
    Combine it with 2FA, such as TOTP or SMS.
- ratherbefuddled 6y ago
  The answer to card fraud is called Strong Customer Authentication and it's a requirement under PSD2. It requires payment service providers to obtain a second factor for authentication. This might be an online banking login and approval, device data capture or an SMS one time code. How is up to the card provider.
  - lotsofpulp 6y ago
    I'm not referring to verification for card fraud, I'm saying the card networks could sell it to anyone that wants to verify a human is on the other end. Like an alternative to Captcha.
    - ratherbefuddled 6y ago
      Strong Customer Authentication should be sufficient to prove that the payment request is authorised by the card holder, given this I'm not sure why a business would pay to be sure there's a human there?
      - lotsofpulp 6y ago
        I’m not referring to payments at all. I’m talking about using the card networks to serve as an alternative to Captcha for things like forums or any other situation besieged by bots and whatnot.
wil421 6y ago
Do you think iPhone users care if it’s harder for Facebook and the like to catch fraud?
- Cipater 6y ago
  I'll flip this one back to you in the same spirit. Do you think iPhone users care that Apple is implementing anti-tracking?
  - CubsFan1060 6y ago
    I do, but mostly as part of the overall message. Folks like my parents will comment about how creepy targeted ads are. When I showed them how to turn it off currently, they were very happy. I don't think they know each setting that is available, but they without doubt have the impression that "Apple is better with privacy"
  - Twisell 6y ago
    Yes we do care Maybe not all of us, but for me it's an important and differentiating feature. What we don't really care about is hypothetical thinking about wether we care from people that apparently don't care.
  - sequoia 6y ago
    They’ll care if Apple tells them to care. Sent from my iPhone
  - wil421 6y ago
    Absolutely and it’s a huge reason I will never use Android. I don’t want an advertising company making my phone.
  - leadingthenet 6y ago
    Yes, it's like half the reason I own Apple devices.
  - coldpie 6y ago
    I've used Android for the past decade, but I'm very strongly considering switching to iPhone because of Apple's pro-privacy moves in iOS over the past year (and also because they are the only manufacturer to make a phone that fits the human hand).
stefan_ 6y ago
Fraud prevention? What exactly are you paying the Apple cut for?
- tenacious_tuna 6y ago
  I think they mean app-side: determining if a user is a bot or not gets harder when you can't tie that user to the datamine'd indicators of their humanity.
  - swiley 6y ago
    Hackernews seems to manage.
    - javajosh 6y ago
      We don't move money around or even have private messaging. If the stakes are high enough, users need the service provider to be skeptical of all client processes, because the risk of being impersonated is born, right or wrong, by the user.
      - swiley 6y ago
        If you move money around then the legal system already exists to deal with fraud. As someone who doesn't use an iphone it's really frustrating that online services are starting to expect one for this reason when it hasn't been necessary in the past.
        tenacious_tuna 6y ago
        There's a cost-benefit balance at play: is using the cost of the legal system (lawyers, evidence, courts, long tail on case times) better than developing a system to prevent fraudulent users? I also wouldn't be surprised if there was a burden of "good faith effort" required to show that you've taken measures to prevent frauds.
        justapassenger 6y ago
Nextgrid 6y ago
> FAANG who have the resources to puzzle the scraps back together for decent conversion tracking with the help of logins, IPs, SDKs with First Party IDs Those are not exempt from the GDPR either. Granted, at the moment there’s very little enforcement around these (especially IP addresses despite their huge tracking potential) but once enforcement is stepped up there shouldn’t be any difference whether it’s a FAANG or a small company doing it).
- deleted 6y ago
  [deleted]
eznzt 6y ago
I don't know why you use a big word such as "fraud" when you mean "we want to be able to know which accounts are owned by the same person".
- jefftk 6y ago
  That isn't what "fraud" means in this context. Ad fraud is when you have something other than a real user loading or clicking on ads. For example, I could stand up a headless browser to click on the ads on my site. This would get me more of a payout from my advertisers, but would also be fraud. A stable identifier makes identifying this sort of behavior much easier. (Disclosure: I work on ads at Google, speaking only for myself)
  - rndgermandude 6y ago
    Ad fraud... How exactly is this my problem as a consumer? This sounds pretty much like a "you" (ad networks and advertisers) problem... So why should you be allowed to spy on me - who never defrauded any advertisers - to fix your problem?
    - jforman 6y ago
      Because it makes advertising more expensive, which in turn makes the products and services you use more expensive.
      - alisonkisk 6y ago
        How is that my problem? I have no interest in advertising more assaulting me with lies.
        deleted 6y ago
        [deleted]
      - coldpie 6y ago
        I would be thrilled if online advertising became unviable as a business model. Most of what makes the web suck today (megabytes of javascript on every page; clickbait articles; outrage-driven social media; warehouses of PII waiting to be bought/sold/stolen) is because of advertising. Yes, I do want to pay for the services I use.
gnu8 6y ago
> puzzle the scraps back together They’re not supposed to do that. Their dogmatic refusal to see the writing on the wall is ridiculous.
chokeartist 6y ago
I'm calling your bluff right now: online advertising, which is underpinned on knowing as much as possible about you, is fucked. The half measures you described will not even be 10% as useful as the current model (direct ID from the device). What are you going to correlate a CG-NAT IP with, when said IP is shared by potentially hundreds of thousands of users? It becomes an exercise of diminishing returns, very quickly. And that is not a defect, that's a feature. Privacy isn't about just maximizing your shekels. It is about protecting and respecting user data. Advertisers are clinically incapable of understanding that second part.
csommers 6y ago
“Fraud”...uh-huh. Please be clear that you mean AD fraud and not fraud-fraud. Also: boohoo
ogre_codes 6y ago
> Fraud prevention for example will get an order of magnitude harder, First Ad Fraud != Fraud. It is low grade hacking. Second. Trading the privacy of every iPhone user so that advertisers can prop up a sketchy/ poor industry is a terrible trade.
- closeparen 6y ago
  This completely changes the game on all kinds of fraud, not just ad fraud. Currently when you get caught, the service you’re abusing bans your device. To keep trying you need new hardware; attacks have a real monetary cost for the attacker. When your iPhone can present itself as infinitely many iPhones, this is neutered, and services will need different (probably more invasive) techniques to keep banned users away.
  - omgwtfbyobbq 6y ago
    Can someone (only) use IMEI plus account instead of IDFA for uniqueness? So if you want to exclude/ban a user, you can use the IMEI+account, but outside of excluding a user from using your service, you cannot access IMEI+account. User privacy is preserved because there's no singular ID for advertisers, and services can still ban fraud because if it's present they can use the IMEI+account to ban a user. Maybe even have that built into the OS? The app can ban someone based on an IMEI+account, but the IMEI+account info stays on the device. The device just certifies that the combination is unique without exposing that info to the app, and the app can still ban that hardware/account, so the user would need to buy new hardware to get around the ban.
    - ogre_codes 6y ago
      The IMEA is worse than the IDFA and neither is needed for this use case.
      - omgwtfbyobbq 6y ago
        It could be. In that case, let the OS handle whether the phone/account are unique, and the app can ban that phone/account without having that unique identifier to ID the person in other cases, like advertising.
_the_inflator 6y ago
I agree here. Apple's privacy changes might seem like a good idea from the outside, but essentially or paradoxically leads to higher entry barriers for new competitors and cement the role the actual players have. However, we do not have experience with so-called "big tech." It is relatively new, iPhone came to light in 2007. So I regard Apple's measurements as another experiment, and we will see how things further evolve.
- adamlett 6y ago
  Apple's privacy changes might seem like a good idea from the outside, but essentially or paradoxically leads to higher entry barriers for new competitors and cement the role the actual players have. Honestly, who cares if the barrier of entry for a shitty business model is raised. And can see only upside to this.
- kergonath 6y ago
  I won’t complain if it makes it harder for fly-by-night ad brokers to set up shop, quite the contrary. I don’t care if the playing field is not level, and we don’t owe them a business. You’re right, things are moving quite fast, but we are also more and more vulnerable. I won’t hesitate between the human right to privacy and a company’s right to make money.
layoutIfNeeded 6y ago
“Fraudsters” can already reset the IDFA from the iOS Settings by turning off personalized ads in the Privacy section.

rpastuszak 6y ago

- fingerprinting (especially if you don't own any premium inventory, as premium publishers generally dislike 3p targeting). - contextual (target the content, make decisions based on _what I'm reading_ now, not who _I am_--less dubious ethically) My favourite one: behavioural rebranded as contextual (I know some companies selling "contextual targeting", where some of the properties clearly define the user, these are mostly ML-based solutions, relying on mobile hardware) Behavioural cross-platform targeting will exist but in a less deterministic form. source: I used to work in AdTech and started a bunch of privacy-related initiatives.

olliej 6y ago

The purpose of IDFA was to provide an identifier that wasn't hardwired to the device - apps were going to absurd lengths to get the UDID, and IDFA gave them something ostensibly sufficient that users could in theory reset at will. I give good odds ad frameworks will again start trying to circumvent the platform security to get a UDID or equivalent.

ogre_codes 6y ago
Then apps get kicked out of the App Store for violating App Store Policy and word gets around that it's a shitty ad network.
- deleted 6y ago
  [deleted]
andrekandre 6y ago
if i remember correctly they (apple) still dont block access to the devices name (e.g "Johns iPad Pro"), so thats also one easy way to fingerprint* even without idfa * to say nothing about the fact that apps can easily get my first name without me knowing it being super creepy

littlestymaar 6y ago

> shameful that a device that is marketed as the gold standard in privacy It's being marketed this way, that's it. It doesn't mean Apple care about privacy, and they prove every once in a while that they don't respect anyone's privacy at all. They spy on their users as much as anyone else (and overall, they have access to much more information than everybody else except Google). All they want to do is prevent third-party tracking on their devices, so they have a monopoly on their users' data. But they do collect those data and they share them with third party “partners”. Don't trust me, just look at their privacy policy, it's explicitly written there: https://www.apple.com/legal/privacy/en-ww/ https://www.apple.com/legal/privacy/en-ww/

objclxt 6y ago
> They spy on their users as much as anyone else (and overall, they have access to much more information than everybody else except Google). This is easily disproven by making a GDPR access request to see what various companies have retained on you, or if you’re extra paranoid inspecting what the device is sending back over the network.
- littlestymaar 6y ago
  Well, less than a month ago all Mac apps worldwide refused to open because the listening service at Apple failed to respond, so you don't even have to look at the network to know that Apple is spying… Apple has access to all apps you open, your position, the content of your iCloud, etc. etc.
  - avianlyric 6y ago
    Yeah you might want to do a little more research on that topic as you clearly have no idea what your talking about. Incidentally did you know that web browsers tell certificate authorities about every website you visit that uses TLS with support for OCSP stapling.
    - account42 6y ago

eivarv 6y ago

Now that the third-party tracking ecosystem is slowly drying out I'm curious what advertisers will come up with to circumvent these new measures. Probably fingerprinting – not to mention the fact that ad-people are lobbying both legislators (including the EU) and standards bodies (like W3C)... and in the latter case they're also directly contributing to the standards.

cafebabbe 6y ago
Most adtech players are legit and don't rely on such practices, illegal in many countries. Of course some smaller one will still try to do it, don't get me wrong.
- eivarv 6y ago
  Well, there's the entire field of databroking (likely completely illegal under GDPR, not to mention unethical from the start) and real time bidding related to this. Given the sorry state of privacy-compliance in general (whether that's ignorance of the law or consciously taking a risk) I seriously doubt that the field of adtech is much better.

sradman 6y ago

> it has literally no purpose beyond mining peoples' data Its main purpose is targeted ads while repurposing or reselling peoples’ data is a nefarious secondary use. Multi-sided markets are important revenue models that are tailored to user preferences and behavior. We are trying to strike a balance; we don’t need to demonize all advertising centric business models to win the argument for better privacy options. I think both Apple and Mozilla are more aligned with my personal preferences but their positions are also perfectly aligned with their core business models.

suprfsat 6y ago
How do you propose to target ads without mining peoples' data?
- thrwn_frthr_awy 6y ago
  If companies can’t target ads without data mining that isn’t an argument for data mining—it’s an argument against targeted ads.
- Bockit 6y ago
  Essentially, you don’t.
- jefftk 6y ago
  One of the most common cases of targeting ads is remarketing: someone comes to your site, they start the process of buying a tablesaw but then leave for whatever reason. You pay to show ads of the saw so they can come back and finish their purchase if they want to. Traditionally, this has been implemented with third party cookies. The retailer drops a cookie on the users browser, and then buys ads to be shown to anyone matching that cookie. I don't know if I would call this data mining, but it is certainly not private. It is possible to build a system that supports remarketing in a private way, however, with new browser APIs: https://github.com/WICG/turtledove https://github.com/WICG/turtledove (Disclosure: I work on ads at Google, speaking only for myself)
  - 6y ago

tmakks 6y ago

> cross-device tracking is on very thin ice legally under the GDPR Exactly and tracking companies such as Adjust or AppsFlyer carry on IFDA-ing/fingerprinting users. GDPR seems to be just a nice-to-have.

doomslice 6y ago

https://www.thetradedesk.com/industry-initiatives/unified-id-solution https://www.thetradedesk.com/industry-initiatives/unified-id... https://www.verizonmedia.com/insights/overcoming-identity-headwinds-connectid https://www.verizonmedia.com/insights/overcoming-identity-he... And probably a dozen other ID solutions out there that require you to be logged in and thus have some first party data to match you with. Honestly I'm not sure what the value proposition is for the user if it's not required to log in, so who knows what the uptake will be.

pwinnski 6y ago

Things have changed really dramatically in in the last 13 years or so. When iPhone first launched, developers could (and did) just grab the UDID of the device and use that. Apple has been restricting things almost from day one, and creating the IDFA in the first place was part of that, but this seems like the biggest step forward by far.