8 ms·

Study: Effectiveness of Apple's app tracking transparency

132 points by clircle 5y ago

bmarquez 5y ago
I use Lockdown for iOS, and Blokada or TrackerControl on Android (they're all very similar, on-device vpn + block list). Even with tracking disabled, apps will still contact third party ad/tracking servers. Just this morning on iOS: - app-measurement.com - play.googleapis.com - googleads.g.doubleclick.net - mobile-collector.newrelic.com - inapps.appsflyer.com - api.mixpanel.com - graph.facebook.com (this is a major offender, even if you don't have Facebook apps installed, other apps love to feed FB data)
- disgruntledphd2 5y ago
  This is mostly for logins, I suspect: https://developers.facebook.com/docs/graph-api https://developers.facebook.com/docs/graph-api
jcranberry 5y ago
> It relies too heavily on trusting the very tracking companies that the policies are supposed to be protecting users against: Apple’s definition allows apps to secretly send any and all of your data to third parties, and as long as those third parties publicly claim they won’t link your data to other sites or sell it, it’s not considered “tracking” by Apple. It is a 100% trust-based honor system, which means that the only way for these companies to get caught “tracking” is to literally pen a public confession of guilt or wrongdoing — something that profit-driven companies are not exactly known for doing. >... >Not only do these trackers allow their clients to break Apple’s rules, but they specifically built features to help their clients easily circumvent Apple’s ATT privacy rules. >First, we created a dummy app that used the Kochava tracking service. With just a few clicks, we configured Kochava to violate Apple’s “ATT Opt-Out” by asking it to tracking users across apps (using “IP address” and “User Agent”) for the purpose of ad targeting (“Paid Media”). Basically, Kochava made it really convenient for any app developer to violate even Apple’s narrow definition of tracking. >We later performed the same test with the AppsFlyer tracking service (which, as previously mentioned, hides the data it sends off your device), and it was even easier to enable “privacy cheat mode” and track users against their consent — all it took was clicking a single button. Wow.
- simonh 5y ago
  There's no way for Apple to stop developers watching what users do in their app, if that app has any kind of server backend at all, and no way to stop developers taking that data and doing whatever they want with it. I mean how is Apple supposed to stop developers accessing data on the developer's own servers? So the only way to disincentivize this behaviour is with policies that ban it and the threat of expulsion from the App Store if you're caught. I know some of these tracking APIs send data to third parties directly, but if that was banned all this traffic would just be re-routed through the app developer's back end so it would just sweep the problem under the carpet. We can see from history with Facebook that shady dealings with data to third parties has been caught in the past, it's quite possible to get away with it but also we know that it also has a tendency to come to light. Anyway, what's the alternative?
  - Grollicus 5y ago
    They could also report this behavior to the appropriate regulators and let them handle the enforcement. Maybe they'll take their time, but they will get there. In the end this is not a technical problem but a juristical one.
  - Apocryphon 5y ago
    > So the only way to disincentivize this behaviour is with policies that ban it and the threat of expulsion from the App Store if you're caught. Then despite all of the anger against restrictive App Store policies and behaviors, the App Store is still insufficient to prevent intrusive user tracking. > Anyway, what's the alternative? OS-level protections that obfuscate on-device data in such a way that third party apps cannot collect the actual data. Or restricting developer access to that information in the first place.
    - b3morales 5y ago
      What specific protection are you envisioning here? An OS that completely locks down access to user input is one that you can't write a useful application for in the first place. Once the OS has handed the program a string the user entered, or a button tap, it can't prevent the program from recording that.
VanillaIceWater 5y ago
blakesterz 5y ago
I've tried using Lockdown and I also tried NextDns on things as well. Lockdown was good, but I like nextdns because I can run it on anything. I don't think I can do the same on Lockdown? Lockdown and Next aren't exactly the same thing, but they do the job quite nicely from what I can see. Checking out the logs on both is always interesting. https://apps.apple.com/us/app/lockdown-privacy/id1469783711 https://apps.apple.com/us/app/lockdown-privacy/id1469783711 https://apps.apple.com/us/app/nextdns/id1463342498 https://apps.apple.com/us/app/nextdns/id1463342498
changoplatanero 5y ago
It must be effective at stopping something, right? Otherwise why is Facebook revenue suffering?
- organic_popcorn 5y ago
  I thought Facebook was having people leave their platforms over the last year.
  - reaperducer 5y ago
    Facebook told investors publicly that the Apple privacy measures cost it something like $10 billion. Though I may be remembering that wrong. It was discussed extensively on HN at the time.
    - blitzar 5y ago
      Shocker: Company CEO blames outside forces for reduction in profits rather than admitting the truth...
      - JimDabell 5y ago
        Their CFO said this, not CEO. Are you suggesting their CFO committed securities fraud by lying to shareholders?
        blitzar 5y ago
        My mistake, but yes I am.
- polyomino 5y ago
  Facebook follows the rules because they are a big target, others not so much...
  - bduerst 5y ago
viktorcode 5y ago
It's weird that former Apple engineers don't explain how IDFA which is blocked by answering "ask app not to track" works. It is the only thing that's prevented by Apple, and the rest lies on the developer. Try to circumvent it, and risk ban (of course some apps are still trying, driven by their risk/reward calculations but bans aren't unheard of). Another thing, the "ask app not to track" doesn't mean that data won't be collected. It means that this particular user must not be identifiable across different apps / web sites, even if personally identifiable data is being sent. Authors completely ignore this point.
- reaperducer 5y ago
  It is the only thing that's prevented by Apple, and the rest lies on the developer. It is the major visible prevention method. App developers who track anyway live in fear of Apple finding out and executing its nuclear option: banning them from the App Store. Smart companies don't risk $10,000,000 in app revenue in order to sell $10,000 in user data.
  - Apocryphon 5y ago
    When your company makes Apple $3m, you cease to become someone casually banned by Apple, and rather a quasi-partner with some leverage. Epic’s ban from the App Store was deliberately engineered by that company’s leadership to force a legal challenge and to garner public attention; most companies of that size with apps on the App Store are met with more kid glove treatment by reviewers.
    - jenny91 5y ago
      I'd imagine the threshold is a lot higher. Remember that Apple is in the end a hardware company and it makes sense to give up revenue/pay a fair bit for the legwork of their privacy marketing.
    - BbzzbB 5y ago
      You're not much of a partner at 0.0008% of yearly revenue. Now if a Netflix or Spotify was caught with a hand in the forbidden cookie jar, I'd expect the solution to be more diplomatic than straightforward perma-ban. If not for directly financial reasons, because their iOS user base would feel the void of these apps missing, unlike "Casino Slots 3D - Dolphin Edition".
ysleepy 5y ago
Apple could start allowing users to disable internet access for an app. Before that happens Apple's privacy campaign is just a lot of hot air.
- snazz 5y ago
  I think you can prevent network access for an app over Wi-Fi on iPhones sold in China, but for some reason this feature hasn’t been made available globally. For now the only option is to disable cellular for an app and disconnect from Wi-Fi.
- olliej 5y ago
  it does?
- ordx 5y ago
  Expect "Please enable internet access to use this app" popup messages in this case. A lot of apps already do this with camera/photos access.
  - sebzim4500 5y ago
    Apple could ban that if they wanted to. Basically just require that as much functionality as possible should work without internet.
  - Razengan 5y ago
    > A lot of apps already do this with camera/photos access. And location, including demanding “precise” tracking (why does Apple even let them detect that?)
  - bduerst 5y ago
    Given the need for almost all apps to have network access, I feel like this would become another website cookie popup that people just click through. i.e. Has the right intentions but just ends up forcing a worse user experience for everyone.
- benrapscallion 5y ago
olliej 5y ago
I think the core thing here is that in a lawsuit a user can now point to an explicit action that they took, and the apps decision not ignore that decision, despite having agreed to obey that decision as part of the use of that app. The fact that stuff like this isn't caught in the automated portion of review is fairly appalling though.
hangonhn 5y ago
Anyone know how Lockdown is funded? The app is free and open source so how are they able to make money and operate? Someone on HN wrote that they always look at how a company is funded before engaging with them so they know where their incentives are. I thought that's a pretty good idea and am trying to apply the same idea here. I can find the backstory but I don't know how the company is able to operate and continue developing.
- bmarquez 5y ago
  They try to upsell VPN services in addition to the free tracker-blocking. They charge $59/year for iOS and $99/year for all Apple devices (according to my app settings). Unfortunately the VPN doesn't support Android or Windows, so I can't use their paid product.
abakker 5y ago
Dumb question: Why don't we just use fuzzing instead of privacy? e.g. the tracking APIs are just filled with noise data when you want to not be tracked? It seems the big issue is that companies doing the tracking know the data is there and then use it inappropriately. What about just giving them garbage data instead?
- divbzero 5y ago
  Specifically for location data, I would love to be able to toggle between actual GPS location and a specified location (e.g. Mountain View CA) that I can set manually.

132 points by clircle 5y ago

I use Lockdown for iOS, and Blokada or TrackerControl on Android (they're all very similar, on-device vpn + block list). Even with tracking disabled, apps will still contact third party ad/tracking servers. Just this morning on iOS: - app-measurement.com - play.googleapis.com - googleads.g.doubleclick.net - mobile-collector.newrelic.com - inapps.appsflyer.com - api.mixpanel.com - graph.facebook.com (this is a major offender, even if you don't have Facebook apps installed, other apps love to feed FB data)

disgruntledphd2 5y ago
This is mostly for logins, I suspect: https://developers.facebook.com/docs/graph-api https://developers.facebook.com/docs/graph-api

jcranberry 5y ago

> It relies too heavily on trusting the very tracking companies that the policies are supposed to be protecting users against: Apple’s definition allows apps to secretly send any and all of your data to third parties, and as long as those third parties publicly claim they won’t link your data to other sites or sell it, it’s not considered “tracking” by Apple. It is a 100% trust-based honor system, which means that the only way for these companies to get caught “tracking” is to literally pen a public confession of guilt or wrongdoing — something that profit-driven companies are not exactly known for doing. >... >Not only do these trackers allow their clients to break Apple’s rules, but they specifically built features to help their clients easily circumvent Apple’s ATT privacy rules. >First, we created a dummy app that used the Kochava tracking service. With just a few clicks, we configured Kochava to violate Apple’s “ATT Opt-Out” by asking it to tracking users across apps (using “IP address” and “User Agent”) for the purpose of ad targeting (“Paid Media”). Basically, Kochava made it really convenient for any app developer to violate even Apple’s narrow definition of tracking. >We later performed the same test with the AppsFlyer tracking service (which, as previously mentioned, hides the data it sends off your device), and it was even easier to enable “privacy cheat mode” and track users against their consent — all it took was clicking a single button. Wow.

simonh 5y ago
There's no way for Apple to stop developers watching what users do in their app, if that app has any kind of server backend at all, and no way to stop developers taking that data and doing whatever they want with it. I mean how is Apple supposed to stop developers accessing data on the developer's own servers? So the only way to disincentivize this behaviour is with policies that ban it and the threat of expulsion from the App Store if you're caught. I know some of these tracking APIs send data to third parties directly, but if that was banned all this traffic would just be re-routed through the app developer's back end so it would just sweep the problem under the carpet. We can see from history with Facebook that shady dealings with data to third parties has been caught in the past, it's quite possible to get away with it but also we know that it also has a tendency to come to light. Anyway, what's the alternative?
- Grollicus 5y ago
  They could also report this behavior to the appropriate regulators and let them handle the enforcement. Maybe they'll take their time, but they will get there. In the end this is not a technical problem but a juristical one.
- Apocryphon 5y ago
  > So the only way to disincentivize this behaviour is with policies that ban it and the threat of expulsion from the App Store if you're caught. Then despite all of the anger against restrictive App Store policies and behaviors, the App Store is still insufficient to prevent intrusive user tracking. > Anyway, what's the alternative? OS-level protections that obfuscate on-device data in such a way that third party apps cannot collect the actual data. Or restricting developer access to that information in the first place.
  - b3morales 5y ago
    What specific protection are you envisioning here? An OS that completely locks down access to user input is one that you can't write a useful application for in the first place. Once the OS has handed the program a string the user entered, or a button tap, it can't prevent the program from recording that.

VanillaIceWater 5y ago

blakesterz 5y ago

I've tried using Lockdown and I also tried NextDns on things as well. Lockdown was good, but I like nextdns because I can run it on anything. I don't think I can do the same on Lockdown? Lockdown and Next aren't exactly the same thing, but they do the job quite nicely from what I can see. Checking out the logs on both is always interesting. https://apps.apple.com/us/app/lockdown-privacy/id1469783711 https://apps.apple.com/us/app/lockdown-privacy/id1469783711 https://apps.apple.com/us/app/nextdns/id1463342498 https://apps.apple.com/us/app/nextdns/id1463342498

changoplatanero 5y ago

It must be effective at stopping something, right? Otherwise why is Facebook revenue suffering?

organic_popcorn 5y ago
I thought Facebook was having people leave their platforms over the last year.
- reaperducer 5y ago
  Facebook told investors publicly that the Apple privacy measures cost it something like $10 billion. Though I may be remembering that wrong. It was discussed extensively on HN at the time.
  - blitzar 5y ago
    Shocker: Company CEO blames outside forces for reduction in profits rather than admitting the truth...
    - JimDabell 5y ago
      Their CFO said this, not CEO. Are you suggesting their CFO committed securities fraud by lying to shareholders?
      - blitzar 5y ago
        My mistake, but yes I am.
polyomino 5y ago
Facebook follows the rules because they are a big target, others not so much...
- bduerst 5y ago

viktorcode 5y ago

It's weird that former Apple engineers don't explain how IDFA which is blocked by answering "ask app not to track" works. It is the only thing that's prevented by Apple, and the rest lies on the developer. Try to circumvent it, and risk ban (of course some apps are still trying, driven by their risk/reward calculations but bans aren't unheard of). Another thing, the "ask app not to track" doesn't mean that data won't be collected. It means that this particular user must not be identifiable across different apps / web sites, even if personally identifiable data is being sent. Authors completely ignore this point.

reaperducer 5y ago
It is the only thing that's prevented by Apple, and the rest lies on the developer. It is the major visible prevention method. App developers who track anyway live in fear of Apple finding out and executing its nuclear option: banning them from the App Store. Smart companies don't risk $10,000,000 in app revenue in order to sell $10,000 in user data.
- Apocryphon 5y ago
  When your company makes Apple $3m, you cease to become someone casually banned by Apple, and rather a quasi-partner with some leverage. Epic’s ban from the App Store was deliberately engineered by that company’s leadership to force a legal challenge and to garner public attention; most companies of that size with apps on the App Store are met with more kid glove treatment by reviewers.
  - jenny91 5y ago
    I'd imagine the threshold is a lot higher. Remember that Apple is in the end a hardware company and it makes sense to give up revenue/pay a fair bit for the legwork of their privacy marketing.
  - BbzzbB 5y ago
    You're not much of a partner at 0.0008% of yearly revenue. Now if a Netflix or Spotify was caught with a hand in the forbidden cookie jar, I'd expect the solution to be more diplomatic than straightforward perma-ban. If not for directly financial reasons, because their iOS user base would feel the void of these apps missing, unlike "Casino Slots 3D - Dolphin Edition".

ysleepy 5y ago

Apple could start allowing users to disable internet access for an app. Before that happens Apple's privacy campaign is just a lot of hot air.

snazz 5y ago
I think you can prevent network access for an app over Wi-Fi on iPhones sold in China, but for some reason this feature hasn’t been made available globally. For now the only option is to disable cellular for an app and disconnect from Wi-Fi.
olliej 5y ago
it does?
ordx 5y ago
Expect "Please enable internet access to use this app" popup messages in this case. A lot of apps already do this with camera/photos access.
- sebzim4500 5y ago
  Apple could ban that if they wanted to. Basically just require that as much functionality as possible should work without internet.
- Razengan 5y ago
  > A lot of apps already do this with camera/photos access. And location, including demanding “precise” tracking (why does Apple even let them detect that?)
- bduerst 5y ago
  Given the need for almost all apps to have network access, I feel like this would become another website cookie popup that people just click through. i.e. Has the right intentions but just ends up forcing a worse user experience for everyone.
benrapscallion 5y ago

olliej 5y ago

I think the core thing here is that in a lawsuit a user can now point to an explicit action that they took, and the apps decision not ignore that decision, despite having agreed to obey that decision as part of the use of that app. The fact that stuff like this isn't caught in the automated portion of review is fairly appalling though.

hangonhn 5y ago

Anyone know how Lockdown is funded? The app is free and open source so how are they able to make money and operate? Someone on HN wrote that they always look at how a company is funded before engaging with them so they know where their incentives are. I thought that's a pretty good idea and am trying to apply the same idea here. I can find the backstory but I don't know how the company is able to operate and continue developing.

bmarquez 5y ago
They try to upsell VPN services in addition to the free tracker-blocking. They charge $59/year for iOS and $99/year for all Apple devices (according to my app settings). Unfortunately the VPN doesn't support Android or Windows, so I can't use their paid product.

abakker 5y ago

Dumb question: Why don't we just use fuzzing instead of privacy? e.g. the tracking APIs are just filled with noise data when you want to not be tracked? It seems the big issue is that companies doing the tracking know the data is there and then use it inappropriately. What about just giving them garbage data instead?

divbzero 5y ago
Specifically for location data, I would love to be able to toggle between actual GPS location and a specified location (e.g. Mountain View CA) that I can set manually.