5 ms·

Can you explain how Apple’s anti tracking measures are going to hurt small business and make fraud easier?

by wil421 6y ago

jefftk 6y ago
Most of the time, privacy and fraud both benefit from the same changes. To prevent tracking online, you want your device to look just like everybody else's devices. To prevent fraud, you want devices to look different so you can tell when a device does not represent a real user. At the extreme, imagine if every person has a unique identifier that was automatically sent whenever they used any device: preventing ad fraud would be really easy, and you would have essentially zero privacy. At the other extreme, imagine if every device looked exactly the same, with no user agent, no IP, no cookies, no way to tell my traffic from yours. In that situation, people would have pretty strong privacy, but if you had headless browsers loading the ads on your site no one would be able to tell that those views were not from real users. As the GGP says, removing IDFA shifts the balance toward both privacy and fraud. See https://blog.cloudflare.com/cloudflare-supports-privacy-pass/ https://blog.cloudflare.com/cloudflare-supports-privacy-pass... and https://web.dev/trust-tokens/ https://web.dev/trust-tokens/ for attempts to separate these. (Disclosure: I work on ads at Google, speaking only for myself.)
- michaelt 6y ago
  > To prevent fraud, you want devices to look different To me, if your system relies on being able to tell most internet users apart, that sounds extremely close to processing personally identifiable information.
  - isignal 6y ago
    It doesn’t need to tell them apart individually, just high level demographics or geography are already useful. If your website suddenly got 99% of traffic from Tibet (random example), you would probably discount those impressions/clicks.
- Nextgrid 6y ago
  > if you had headless browsers loading the ads on your site no one would be able to tell that those views were not from real users This seems like a problem with the current model of ads being paid for by impression/click, and switching to a model where ads are being paid for the time they're being displayed (pay X to have your ad appear here for Y time) the problem goes away. Furthermore, the current advertiisng model also suffers from this problem even beyond malicious intent. Is it fraud if a real user "looks" at the ad but actually looks away from their screen? If they mute the sound? If they don't speak the language the ad is in? Etc.
  - jefftk 6y ago
    > switching to a model where ads are being paid for the time they're being displayed (pay X to have your ad appear here for Y time) the problem goes away I don't think it does. How does the advertiser know what the spot on the site is worth without traffic estimates? See my response to chongli downthread: https://news.ycombinator.com/item?id=25431138 https://news.ycombinator.com/item?id=25431138 > Is it fraud if a real user "looks" at the ad but actually looks away from their screen? If they mute the sound? If they don't speak the language the ad is in? None of these are fraud, because the ad is in front of a real user. Fraud here doesn't mean "the ad doesn't perform as well as the advertiser hoped for some reason" it means "the ad was not actually shown to real users on the site, contrary to the agreement between the publisher and the advertiser".
  - nitrogen 6y ago
    pay X to have your ad appear here for Y time Someone once told me how they got a bunch of cheap/used phones and just left them all running an app that shows ads. They'd glance at the phones now and then to see if they needed to "interact" with them to keep the ads rolling.
- GoblinSlayer 6y ago
  By fraud you mean ad fraud?
  - jefftk 6y ago
    Yes; we're talking about endymi0n's claim in https://news.ycombinator.com/item?id=25429278 https://news.ycombinator.com/item?id=25429278 that without IDFA preventing ad fraud is (a) harder and (b) disproportionately harder for smaller players
- thesuitonym 6y ago
  >but if you had headless browsers loading the ads on your site no one would be able to tell that those views were not from real users. There is literally nothing in the world I care about less than this.
  - jefftk 6y ago
    Of course you don't care about it directly, but it is part of a chain that funds things you probably do care about? Advertisers pay publishers to show their ads to real users. Publishers run their sites because they receive money from advertisers. We visit the sites because they're diverting/informative/useful/etc. If the advertisers can't tell whether their ads are instead shown to robots, the whole thing falls apart. I like the trust tokens proposal as a way to exclude bot traffic without tracking: https://web.dev/trust-tokens/ https://web.dev/trust-tokens/
    - isignal 6y ago
      This is an interesting proposal, thanks for sharing.
    - pabs3 6y ago
      Shouldn't advertisers instead care about the acquisition cost per customer and revenue per customer? Do publishers not offer pricing based on these things?
- thatcat 6y ago
  > if you had headless browsers loading the ads on your site no one would be able to tell that those views were not from real users What users actually care about protecting your propaganda based business model though? Sounds like it's pretty much your problem and you want to reduce privacy to make manipulating their behavior a bit more profitable.
- elefanten 6y ago
  Google’s inability to protect its core revenue stream is squarely in the “not my problem” category. In fact, making internet advertising less desirable for businesses sounds like a benefit to me. So, Apple’s decision is looking even better to me now.
  - halversonmd 6y ago
    Google's core revenue stream doesn't rely on IDFA. Many 3rd party advertising companies and apps do rely on IDFA. Apple's move helps Google.
    - bluesign 6y ago
      This is not true, any ad network benefits from IDFA, bigger the better. Removing of IDFA should close the gap between big players like Google, Facebook etc vs others.
      - dialtone 6y ago
        I don't do mobile advertising but this is just incorrect... Most of Google's revenue comes from Search and that has nothing to do with IDFA. Then how would third parties with no access to first party data compete when there's no more third party data would be something I'm curious for you to explain.
        bluesign 6y ago
        Ok first of all I am not saying that third parties without access to first party data will compete with google's search ad business. I think after removal of IDFA, smaller ad networks will steal some of big players mobile market share. And mobile advertising will not move to search based advertisement as much as you think. Maybe some revenue will shift there, but I think lose on mobile side will be bigger.
        halversonmd 6y ago
        Google's search revenue accounts for around 95% of it's top line revenue. Google’s ability to protect its core revenue stream is squarely in the “not impacted” category when it comes to Apple's IDFA move.
- raxxorrax 6y ago
  As a user I would like zero tracking because I don't care about ad fraud that much. I also think advertisers and contemporaries collecting my info is a security problem or even a breach.
- alibarber 6y ago
  I was expecting fraud here to refer to that which might impact the user in some way (i.e. credit card / bank, identity, fraud etc) - was genuinely surprised that other people read 'ad fraud' from this...
- willstrafach 6y ago
  1. You’re allowed to use IDFA. But users will now have to allow access, as a permission dialog will pop up first. 2. The IDFA is just a simple static UUID. It cannot do a very good job at preventing fraud. There is no way to validate anything about it or affirm that it ties to a genuine device.
  - jefftk 6y ago
    1: I expect this will translate to the majority of traffic will not have IDFA available, either by apps not wanting to annoy users by asking, or users saying no. 2: On a single request, yes. But users typically make very large numbers of requests over time. The pattern of requests that you'd see from a real user looks pretty different than what you'd see from a bot.
    - thatcat 6y ago
      >2 Of course they look different over time, isn't the problem here that same data can be used to do statistical analysis for other purposes than fraud prevention?
      - jefftk 6y ago
        I'm responding here to willstrafach 's claim that "The IDFA is just a simple static UUID. It cannot do a very good job at preventing fraud" and wil421's earlier "Can you explain how Apple’s anti tracking measures are going to hurt small business and make fraud easier?" But yes, of course IDFA can be used for things other than ad fraud detection.
- egsmi 6y ago
  > To prevent fraud Honest question, I am not trying to be obtuse, but in this context can you more specifically define fraud? Is it just "ad fraud" as defined here: https://www.clickcease.com/blog/what-is-ad-fraud/ https://www.clickcease.com/blog/what-is-ad-fraud/ I get why businesses should care about ad fraud, but why should I, as a consumer care about it? Frankly I don't even want to know about my traffic, let alone yours.
  - jefftk 6y ago
    Yes, ad fraud. We're talking about endymi0n's claim in https://news.ycombinator.com/item?id=25429278 https://news.ycombinator.com/item?id=25429278 that without IDFA preventing ad fraud is (a) harder and (b) disproportionately harder for smaller players. As for why you should care about it, see my response to thesuitonym below: https://news.ycombinator.com/item?id=25431866 https://news.ycombinator.com/item?id=25431866
malandrew 6y ago
The cost of a phone becomes a barrier to scaling fraud because once you use a phone for fraud it can be blacklisted. Advertiser fraud is hardly the only type of fraud. It happens with services you directly pay for like ridesharing and food delivery as well. The cost of fraud becomes another cost for a service provider and prices for all users need to be raised to offset losses from fraud. For smaller businesses without the brain power to combat fraud, their margins will be greatly hurt by fraud, making it harder to compete. I'm in favor of what Apple is doing myself, but it's definitely a legitimate unintended consequence of this measure. What would be useful is if Apple became the gatekeeper for tracking fraud and companies could report ephemeral identifiers for fraud that only Apple can de-anonymize and then Apple provides fraud scores for ephemeral identifiers on account signup.

Can you explain how Apple’s anti tracking measures are going to hurt small business and make fraud easier?

by wil421 6y ago

Can you explain how Apple’s anti tracking measures are going to hurt small business and make fraud easier?

Most of the time, privacy and fraud both benefit from the same changes. To prevent tracking online, you want your device to look just like everybody else's devices. To prevent fraud, you want devices to look different so you can tell when a device does not represent a real user. At the extreme, imagine if every person has a unique identifier that was automatically sent whenever they used any device: preventing ad fraud would be really easy, and you would have essentially zero privacy. At the other extreme, imagine if every device looked exactly the same, with no user agent, no IP, no cookies, no way to tell my traffic from yours. In that situation, people would have pretty strong privacy, but if you had headless browsers loading the ads on your site no one would be able to tell that those views were not from real users. As the GGP says, removing IDFA shifts the balance toward both privacy and fraud. See https://blog.cloudflare.com/cloudflare-supports-privacy-pass/ https://blog.cloudflare.com/cloudflare-supports-privacy-pass... and https://web.dev/trust-tokens/ https://web.dev/trust-tokens/ for attempts to separate these. (Disclosure: I work on ads at Google, speaking only for myself.)

michaelt 6y ago
> To prevent fraud, you want devices to look different To me, if your system relies on being able to tell most internet users apart, that sounds extremely close to processing personally identifiable information.
- isignal 6y ago
  It doesn’t need to tell them apart individually, just high level demographics or geography are already useful. If your website suddenly got 99% of traffic from Tibet (random example), you would probably discount those impressions/clicks.
Nextgrid 6y ago
> if you had headless browsers loading the ads on your site no one would be able to tell that those views were not from real users This seems like a problem with the current model of ads being paid for by impression/click, and switching to a model where ads are being paid for the time they're being displayed (pay X to have your ad appear here for Y time) the problem goes away. Furthermore, the current advertiisng model also suffers from this problem even beyond malicious intent. Is it fraud if a real user "looks" at the ad but actually looks away from their screen? If they mute the sound? If they don't speak the language the ad is in? Etc.
- jefftk 6y ago
  > switching to a model where ads are being paid for the time they're being displayed (pay X to have your ad appear here for Y time) the problem goes away I don't think it does. How does the advertiser know what the spot on the site is worth without traffic estimates? See my response to chongli downthread: https://news.ycombinator.com/item?id=25431138 https://news.ycombinator.com/item?id=25431138 > Is it fraud if a real user "looks" at the ad but actually looks away from their screen? If they mute the sound? If they don't speak the language the ad is in? None of these are fraud, because the ad is in front of a real user. Fraud here doesn't mean "the ad doesn't perform as well as the advertiser hoped for some reason" it means "the ad was not actually shown to real users on the site, contrary to the agreement between the publisher and the advertiser".
- nitrogen 6y ago
  pay X to have your ad appear here for Y time Someone once told me how they got a bunch of cheap/used phones and just left them all running an app that shows ads. They'd glance at the phones now and then to see if they needed to "interact" with them to keep the ads rolling.
GoblinSlayer 6y ago
By fraud you mean ad fraud?
- jefftk 6y ago
  Yes; we're talking about endymi0n's claim in https://news.ycombinator.com/item?id=25429278 https://news.ycombinator.com/item?id=25429278 that without IDFA preventing ad fraud is (a) harder and (b) disproportionately harder for smaller players
thesuitonym 6y ago
>but if you had headless browsers loading the ads on your site no one would be able to tell that those views were not from real users. There is literally nothing in the world I care about less than this.
- jefftk 6y ago
  Of course you don't care about it directly, but it is part of a chain that funds things you probably do care about? Advertisers pay publishers to show their ads to real users. Publishers run their sites because they receive money from advertisers. We visit the sites because they're diverting/informative/useful/etc. If the advertisers can't tell whether their ads are instead shown to robots, the whole thing falls apart. I like the trust tokens proposal as a way to exclude bot traffic without tracking: https://web.dev/trust-tokens/ https://web.dev/trust-tokens/
  - isignal 6y ago
    This is an interesting proposal, thanks for sharing.
  - pabs3 6y ago
    Shouldn't advertisers instead care about the acquisition cost per customer and revenue per customer? Do publishers not offer pricing based on these things?
thatcat 6y ago
> if you had headless browsers loading the ads on your site no one would be able to tell that those views were not from real users What users actually care about protecting your propaganda based business model though? Sounds like it's pretty much your problem and you want to reduce privacy to make manipulating their behavior a bit more profitable.
elefanten 6y ago
Google’s inability to protect its core revenue stream is squarely in the “not my problem” category. In fact, making internet advertising less desirable for businesses sounds like a benefit to me. So, Apple’s decision is looking even better to me now.
- halversonmd 6y ago
  Google's core revenue stream doesn't rely on IDFA. Many 3rd party advertising companies and apps do rely on IDFA. Apple's move helps Google.
  - bluesign 6y ago
    This is not true, any ad network benefits from IDFA, bigger the better. Removing of IDFA should close the gap between big players like Google, Facebook etc vs others.
    - dialtone 6y ago
      I don't do mobile advertising but this is just incorrect... Most of Google's revenue comes from Search and that has nothing to do with IDFA. Then how would third parties with no access to first party data compete when there's no more third party data would be something I'm curious for you to explain.
      - bluesign 6y ago
        Ok first of all I am not saying that third parties without access to first party data will compete with google's search ad business. I think after removal of IDFA, smaller ad networks will steal some of big players mobile market share. And mobile advertising will not move to search based advertisement as much as you think. Maybe some revenue will shift there, but I think lose on mobile side will be bigger.
        halversonmd 6y ago
        Google's search revenue accounts for around 95% of it's top line revenue. Google’s ability to protect its core revenue stream is squarely in the “not impacted” category when it comes to Apple's IDFA move.
raxxorrax 6y ago
As a user I would like zero tracking because I don't care about ad fraud that much. I also think advertisers and contemporaries collecting my info is a security problem or even a breach.
alibarber 6y ago
I was expecting fraud here to refer to that which might impact the user in some way (i.e. credit card / bank, identity, fraud etc) - was genuinely surprised that other people read 'ad fraud' from this...
willstrafach 6y ago
1. You’re allowed to use IDFA. But users will now have to allow access, as a permission dialog will pop up first. 2. The IDFA is just a simple static UUID. It cannot do a very good job at preventing fraud. There is no way to validate anything about it or affirm that it ties to a genuine device.
- jefftk 6y ago
  1: I expect this will translate to the majority of traffic will not have IDFA available, either by apps not wanting to annoy users by asking, or users saying no. 2: On a single request, yes. But users typically make very large numbers of requests over time. The pattern of requests that you'd see from a real user looks pretty different than what you'd see from a bot.
  - thatcat 6y ago
    >2 Of course they look different over time, isn't the problem here that same data can be used to do statistical analysis for other purposes than fraud prevention?
    - jefftk 6y ago
      I'm responding here to willstrafach 's claim that "The IDFA is just a simple static UUID. It cannot do a very good job at preventing fraud" and wil421's earlier "Can you explain how Apple’s anti tracking measures are going to hurt small business and make fraud easier?" But yes, of course IDFA can be used for things other than ad fraud detection.
egsmi 6y ago
> To prevent fraud Honest question, I am not trying to be obtuse, but in this context can you more specifically define fraud? Is it just "ad fraud" as defined here: https://www.clickcease.com/blog/what-is-ad-fraud/ https://www.clickcease.com/blog/what-is-ad-fraud/ I get why businesses should care about ad fraud, but why should I, as a consumer care about it? Frankly I don't even want to know about my traffic, let alone yours.
- jefftk 6y ago
  Yes, ad fraud. We're talking about endymi0n's claim in https://news.ycombinator.com/item?id=25429278 https://news.ycombinator.com/item?id=25429278 that without IDFA preventing ad fraud is (a) harder and (b) disproportionately harder for smaller players. As for why you should care about it, see my response to thesuitonym below: https://news.ycombinator.com/item?id=25431866 https://news.ycombinator.com/item?id=25431866

malandrew 6y ago

The cost of a phone becomes a barrier to scaling fraud because once you use a phone for fraud it can be blacklisted. Advertiser fraud is hardly the only type of fraud. It happens with services you directly pay for like ridesharing and food delivery as well. The cost of fraud becomes another cost for a service provider and prices for all users need to be raised to offset losses from fraud. For smaller businesses without the brain power to combat fraud, their margins will be greatly hurt by fraud, making it harder to compete. I'm in favor of what Apple is doing myself, but it's definitely a legitimate unintended consequence of this measure. What would be useful is if Apple became the gatekeeper for tracking fraud and companies could report ephemeral identifiers for fraud that only Apple can de-anonymize and then Apple provides fraud scores for ephemeral identifiers on account signup.