8 ms·

Right, but that second click isn't coming from Apple and they can't control it. The article specifically says that many apps feel like they need additional cons

by ezfe 2y ago

Right, but that second click isn't coming from Apple and they can't control it. The article specifically says that many apps feel like they need additional consent which means they have to request it through two channels. If Apple doesn't feel like they need additional consent and/or doesn't use ATT-blocked systems then they don't need that. This is stupid.

maccard 2y ago
> The article specifically says that many apps feel like they need additional consent which means they have to request it through two channels. Surely the same argument can be applied to the cookie law - many sites feel like they need consent therefore it's unfair over people who think they only need one prompt.
leereeves 2y ago
> The article specifically says that many apps feel like they need additional consent Are they right about that? Does Apple provide the app with confirmation that the user consented, and if they do, is it legal to rely on that confirmation?
- stagalooo 2y ago
  > Third-party publishers "cannot rely on the ATT framework to comply with their legal obligations," so they "must continue to use their own consent collection solution," the French agency said. This absolutely sounds like a problem caused by the law and not apple. Apps can’t rely on the prompt for legal authorization (presumably because it is filtered through apples apis?) and must therefore ask themselves. The only two solutions I see to this is either Apple can’t prompt which means they can’t protect the user or the law can change to accept the prompt as authorization to track.
- gruez 2y ago
  You can definitely check on whether the user answered yes to the prompt, because if they declined you'll get a null (ie. all 0s) uuid. Whether app developers can rely on that as confirmation for tracking on their side is a purely legal question, and I wish the French government would try to resolve it on their side rather than going straight to fining Apple.
  - Swenrekcah 2y ago
    As a European Apple user I welcome any and all fines that can be levied on Apple for their anticompetitive practices.
    - gruez 2y ago
      What's "anticompetitive" here? If the description provided in my previous comment is correct, it seems to be more of a failure on the part of the regulators than anything else. The EU (through GDPR) also wants some sort of affirmative consent for tracking. That's fair, and results in one prompt. However, iOS obviously can't accept a "trust me bro" from the app itself that it's okay to enable cross-app tracking, so you need a second prompt. The obvious solution would be to combine the two, by allowing the ATT prompt to be used as consent for the purposes of GDPR. Why didn't French regulators go with this solution and decide to fine Apple instead?
      - refulgentis 2y ago
        "there is an "asymmetry" in which user consent for Apple's own data collection is obtained with a single pop-up, but other publishers are "required to obtain double consent from users for tracking on third-party sites and applications." more @ https://news.ycombinator.com/item?id=24109695 https://news.ycombinator.com/item?id=24109695 (via https://www.forbes.com/sites/johnkoetsier/2020/08/07/apple-ad-network-gets-special-privileges-that-facebook-google-wont-on-ios14/ https://www.forbes.com/sites/johnkoetsier/2020/08/07/apple-a...) EDIT: Throttled, so reply can go here: > My previous comment directly addresses the "asymmetry" aspect. Apologies, you asked what the asymmetry was and I guess I'm still rather confused even after reviewing the thread. I think I've had too much caffeine...or not enough? :) > The obvious solution would be to combine the two, by allowing the ATT prompt to be used as consent for the purposes of GDPR. Why didn't French regulators go with this solution and decide to fine Apple instead? I've been involved in regulatory stuff before and it's considered overreach, generally, when the government does UX design for you. Hopefully, that's a solution Apple can consider, it's a great idea on your end, excellent for users and competition.
bilbo0s 2y ago
Right. I'm not sure this is fixable? Or maybe there is widespread misunderstanding of the requirements in this scenario? But I also thought the rule was tough enough to require verifying that extra consent? Maybe it's not? Truly confused here.
- duskwuff 2y ago
  > I'm not sure this is fixable? Not from Apple's end. Apple mandates that all requests for permissions go through a single, OS-provided dialog. If a user accepts, the permission is granted; if the user rejects, the permission is not granted, and the app can't ask again. Simple enough. App developers try to maximize their chances of getting that permission granted by adding another warm-up dialog before actually doing the official permissions request. Since those other dialogs aren't part of Apple's permissions request chain, they can be rejected by the user without consequence, and the app can present them as often as it wants. There is nothing which requires third-party developers to use these additional dialogs. It's a design pattern (and an annoying one at that) which many developers have gravitated towards. Not all developers use it; in particular, Apple doesn't use it for their first-party apps. And apparently FCA is faulting Apple for not following that pattern themselves.
  - refulgentis 2y ago
    > There is nothing which requires third-party developers to use these additional dialogs. Well, yes there is: I don't have carte blanche to do whatever I want with your data because you tapped an Apple dialog: I have to obtain your consent first.
    - benmanns 2y ago
      This is interesting to me—are you an app developer that does this pattern for that reason? I definitely figured it was exclusively because they can request repeatedly for the fake prompt, and only “use” their prompt when the user is inclined to accept. There are times where I’ll accept the first prompt and reject the second prompt when apps are spammy about it.
    - 2y ago

by ezfe 2y ago

maccard 2y ago

> The article specifically says that many apps feel like they need additional consent which means they have to request it through two channels. Surely the same argument can be applied to the cookie law - many sites feel like they need consent therefore it's unfair over people who think they only need one prompt.

leereeves 2y ago

> The article specifically says that many apps feel like they need additional consent Are they right about that? Does Apple provide the app with confirmation that the user consented, and if they do, is it legal to rely on that confirmation?

stagalooo 2y ago
> Third-party publishers "cannot rely on the ATT framework to comply with their legal obligations," so they "must continue to use their own consent collection solution," the French agency said. This absolutely sounds like a problem caused by the law and not apple. Apps can’t rely on the prompt for legal authorization (presumably because it is filtered through apples apis?) and must therefore ask themselves. The only two solutions I see to this is either Apple can’t prompt which means they can’t protect the user or the law can change to accept the prompt as authorization to track.
gruez 2y ago
You can definitely check on whether the user answered yes to the prompt, because if they declined you'll get a null (ie. all 0s) uuid. Whether app developers can rely on that as confirmation for tracking on their side is a purely legal question, and I wish the French government would try to resolve it on their side rather than going straight to fining Apple.
- Swenrekcah 2y ago
  As a European Apple user I welcome any and all fines that can be levied on Apple for their anticompetitive practices.
  - gruez 2y ago
    What's "anticompetitive" here? If the description provided in my previous comment is correct, it seems to be more of a failure on the part of the regulators than anything else. The EU (through GDPR) also wants some sort of affirmative consent for tracking. That's fair, and results in one prompt. However, iOS obviously can't accept a "trust me bro" from the app itself that it's okay to enable cross-app tracking, so you need a second prompt. The obvious solution would be to combine the two, by allowing the ATT prompt to be used as consent for the purposes of GDPR. Why didn't French regulators go with this solution and decide to fine Apple instead?
    - refulgentis 2y ago
      "there is an "asymmetry" in which user consent for Apple's own data collection is obtained with a single pop-up, but other publishers are "required to obtain double consent from users for tracking on third-party sites and applications." more @ https://news.ycombinator.com/item?id=24109695 https://news.ycombinator.com/item?id=24109695 (via https://www.forbes.com/sites/johnkoetsier/2020/08/07/apple-ad-network-gets-special-privileges-that-facebook-google-wont-on-ios14/ https://www.forbes.com/sites/johnkoetsier/2020/08/07/apple-a...) EDIT: Throttled, so reply can go here: > My previous comment directly addresses the "asymmetry" aspect. Apologies, you asked what the asymmetry was and I guess I'm still rather confused even after reviewing the thread. I think I've had too much caffeine...or not enough? :) > The obvious solution would be to combine the two, by allowing the ATT prompt to be used as consent for the purposes of GDPR. Why didn't French regulators go with this solution and decide to fine Apple instead? I've been involved in regulatory stuff before and it's considered overreach, generally, when the government does UX design for you. Hopefully, that's a solution Apple can consider, it's a great idea on your end, excellent for users and competition.

bilbo0s 2y ago

Right. I'm not sure this is fixable? Or maybe there is widespread misunderstanding of the requirements in this scenario? But I also thought the rule was tough enough to require verifying that extra consent? Maybe it's not? Truly confused here.

duskwuff 2y ago
> I'm not sure this is fixable? Not from Apple's end. Apple mandates that all requests for permissions go through a single, OS-provided dialog. If a user accepts, the permission is granted; if the user rejects, the permission is not granted, and the app can't ask again. Simple enough. App developers try to maximize their chances of getting that permission granted by adding another warm-up dialog before actually doing the official permissions request. Since those other dialogs aren't part of Apple's permissions request chain, they can be rejected by the user without consequence, and the app can present them as often as it wants. There is nothing which requires third-party developers to use these additional dialogs. It's a design pattern (and an annoying one at that) which many developers have gravitated towards. Not all developers use it; in particular, Apple doesn't use it for their first-party apps. And apparently FCA is faulting Apple for not following that pattern themselves.
- refulgentis 2y ago
  > There is nothing which requires third-party developers to use these additional dialogs. Well, yes there is: I don't have carte blanche to do whatever I want with your data because you tapped an Apple dialog: I have to obtain your consent first.
  - benmanns 2y ago
    This is interesting to me—are you an app developer that does this pattern for that reason? I definitely figured it was exclusively because they can request repeatedly for the fake prompt, and only “use” their prompt when the user is inclined to accept. There are times where I’ll accept the first prompt and reject the second prompt when apps are spammy about it.
  - 2y ago