Trouble in Privacy Paradise? How Apple’s New Privacy Strategy and iOS Affects Merchants

Why is iOS 14 Such a Big Deal?

Over the past few years, Apple has continually upped their efforts to improve privacy controls on all of their platforms. The iOS 14 update, however, takes this to a level that Facebook finds offensive enough to sue Apple. Additionally, Facebook has launched a major ad campaign claiming that Apple is out to hurt small businesses.

To simplify iOS14 privacy controls, we can break them down into two components.. First, there is App Tracking Transparency (ATT) which is the policy most of us are aware of. This basically says that apps have to disclose to users how they track them. The second is Private Click Measurement (PCM). This is a new framework for tracking attribution of advertisers on the user’s device. Additionally, Apple requires app owners to disclose how they will use your data.

Disclosures tend to be long and unread. However, I encourage you to read a few... while sitting down.

Apple claims to be a privacy advocate to which it arguably has the most credibility among the tech giants. At the same time, they claim to be supportive of advertising attribution tracking (who gets credit for the sale). That is why ATT and PCM go hand-in-hand.

Nonetheless, PCM does limit the number of tracking events and delays attribution reporting by 24 to 48 hours. This will diminish the effectiveness of Facebook ad campaigns which thrive on vacuuming up as much private data as possible.

Where Google, Facebook, and Apple Stand

I find it disheartening that Facebook, who claims to be cracking down on fake news, is essentially manufacturing their own as a basis for their claims. Their stated position that they are standing up for small businesses is both pathetic and opaque, and reminiscent of Trump’s tactics of riling up his followers. I don’t believe they will find too many supporters in the small business community.

Google is surprisingly calm, even supportive, at least on their public pronouncements. While there may be some short-term financial risk if Apple runs too quickly, Google’s first concern is the long-term health of the open web which requires both increased privacy and the ability of content providers to fund their activities through advertising.

At the same time, Google is notoriously data-hungry and must walk a tightrope of supporting privacy and violating it to provide value to advertisers. My sense is that Google is indulging in some short term virtue-signaling while retooling their business model in the long run.

That being said, iOS users accessing Google via their app is probably a smaller slice of their business. Even desktop users running OS X tend to use Google’s browser which siphons off an enormous amount of tracking data.

In contrast, Facebook and Instagram are heavily dependent on iOS app users. This makes sense if you consider that Facebook is one of Google’s largest competitors for advertising revenue. Because of this, blunting Facebook’s power might play in Google’s favor.

At the same time, Facebook bemoans the fact that Apple is using privacy as a pretext to creating an advantage for Apple’s own advertising by imposing rules on everyone but themselves.

Real Cause for Privacy Concerns

So, the biggest user difference in the media has been the new popup that appears when you use an app on your iPhone. This popup asks if you want to grant the app owner permission to track you on other websites and apps. While researching this article, I wondered what the brouhaha was all about and which apps were wanting to track me, so I took a look.

The biggest concern is the apps sharing data with other companies, even if they aren’t making money from it. Even if my Personally Identifiable Information (PII) is not shared it only takes a few pieces of metadata to identify me via my digital fingerprint.

“It’s best to regard metadata not as some benign abstraction, but as the very essence of content.”

Edward Snowden, “Permanent Record.”

What is true for nefarious state actors is also true for big tech. Unfortunately, they are one in the same thing as intelligence agencies (including the USA’s) require phone companies and tech giants to hand over massive amounts of data while barring them from disclosing it to their users.

Large tech and telecommunications companies do an enormous amount of business with governments and tend not to fight the intrusion - at least, not fight very hard.

Who is Sharing Data?

Everyone.

I’m a beta user of iOS 14.4 and decided to use the new tools to see which app is tracking what. The most important setting seems to be the cross-app tracking piece. This essentially allows owners of applications to assign an ID to you and allow other apps to share this ID.

Facebook and other app developers claim this is needed to track advertising attribution to make sure you only get relevant ads served up to you. On the downside, as mentioned in The Social Dilemma, these algorithms amplify your personal echo chamber and help drive divisions in society. Personally, I value exposure to new things and ideas more than what search engines and social media platforms think is relevant. Sorry, Mark.

Privacy Policies

App developers, under the new rules must also disclose privacy practices and those practices must adhere to Apple’s standards. Looking at a couple of them makes me wonder about those standards.

The Privacy Policies for the CNN and FOX NEWS apps are pretty consistent. Did you know that when you click on an article in FOX that your local affiliate knows it? What the heck is a ‘participatory database,’ CNN? Most app developers include this sort of vague, legalistic language so that you don’t ask questions. Interestingly, the Wall Street Journal policy... whose content I pay for... has the same wording with only slightly tighter language and controls.

It is noteworthy that Apple allows some apps to share information you provide without your consent for fraud detection and similar uses. The companies using the information for these purposes are given very specific guidelines that it must be deleted afterwards. While without this stipulation, ecommerce on your phone would be impossible, adherence to Apple’s policies is up to the providers who receive it.

Examples of the data collected that seem like sheer overreach

Why does Google Maps need access to Apple Music?

Do I really want to give access to my contacts to Alexa, Instagram, SAP Concur, and Uber?

Reddit, since Tencent became a substantial owner, has upped the information they want to track. Seriously, why does Reddit need to know where I am at all times?

Nest, another Amazon property, is just a thermostat. Why does it need to pull data from my Bluetooth devices and my microphone of all things? I suppose that is when talking to visitors using Nest’s doorbell - but I only have the thermostat.

Facebook needs to explain WHY it wants to poke around my local network and access other devices. I’m assuming it is looking for a Facebook Portal, but I’m also guessing it serves the additional purpose of figuring out which game consoles I use. Since my Samsung TV, Apple TV, Roku TV, computers, and phones all connect to that network, Facebook and Instagram (if I used it often enough, which I don’t) could encourage me to buy new equipment by serving up relevant ads. If that doesn’t work, they will sell the data to other companies.

Why Facebook is Going to Lose This Argument

This issue is all about consent. If we’ve learned anything from the past few years, we’ve learned that consent is good, right?

The problem for Facebook is that their strategy relies on secretly compiling user information. If consumers grant Facebook the right to track them, then, they lose nothing. However, if their users balk at the amount of data Facebook siphons off their iPhone it changes the business model. This business model relies on opacity.

iOS 14 opens up a new set of windows on just who is tracking you (including Apple, by the way). Nudging iPhone users, some of whom buy Apple phones for privacy reasons, to confront the level of data they are sharing feels like a move in the right direction.

Even Google admits that cross-site or cross-app tracking of behavior is a privacy hazard. Web standards groups like W3C and ECMA all profess to be concerned and open-source initiatives are under way to eliminate or curtail the practice. Google will remove cross-site cookies completely from Chrome later this year. With time, Facebook may have trouble tracking on a browser.

What About Apple’s Advertising Platform?

Apple definitely serves up advertising and one of Facebook’s main arguments: Apple is favoring its service to the detriment of other companies.

It’s a false equivalent, though. Apple’s advertising platform does not track you across apps and websites owned by other companies. Yet, a read-through of Apple’s Advertising & Privacy Policy does show that it shares information with third parties albeit in a more restrictive way.

The Apple apps that serve ads are Music, Books, Games, News, and the App Store to name a few. Apple users expect their devices and services to work together. Both Apple and Facebook document their privacy policies. However, Facebook takes the approach of sharing data by default while Apple’s seems to be more aligned with privacy by default.

Apple does state when and where they might share your information and more specifically how they share it through segments. I.e., they won’t allow advertisers to target an individual user, rather, they segment users into sets of 5,000 or more people to maintain anonymity. In any case, Apple does allow you to block personalized ads...

In short, while Apple does rely on your personal information to a certain extent, Facebook is asking for VERY personal and VERY identifiable information. I have to side with Tim Cook on this one.

“If a business is built on misleading users, on data exploitation, on choices that are no choices at all, it does not deserve our praise. It deserves reform.”

- Tim Cook

The Effect of iOS 14 on Advertisers

I’m not an expert on digital advertising, so I consulted one for this section. Craig Schapiro, one of the digital marketing gurus at SmartClick Advertising, graciously accorded me some of his time. SmartClick serves a variety of company sizes and sectors including B2B and B2C verticals. The folks at SmartClick keep on top of new developments because advertising conversion is their stock and trade.

It’s more about how you track than if you can track according to Craig. Apple’s move affects advertisers still relying on tracking pixels alone more than those who have also implemented Facebook’s Conversion Tracking API; but everyone will be affected. VERY small advertisers tend to use pixel tracking because it is easy to implement via Google Tag Manager. Those who are not paying attention or lack the ability to implement the API may lose a marginal amount of targeting capability. Clients who have an agency like SmartClickAds should be able to navigate the issue.

Even so, Craig sees this as a challenge (one among many) but not a game changer. He explains, “It all depends on the percentages: how many people actually opt out of tracking.” Craig emphasized that we have no idea how many will opt out. If less than 50% do because “people like ads to be relevant,” the impact will be minimal for most advertisers.

“Facebook is all about finding lookalikes to target. As long as you have enough people opting in, you will be able to create effective lookalikes,” says Craig. Most advertisers will still have a larger pool of prospects to target than their budgets allow.

Craig says there has been a race between privacy concerns and technology to improve targeting/conversion going on for some time. He feels that progress for advertisers will continue, especially as other platforms up their game (Twitter, Reddit, et al.). The largest impact will probably be a small hit to Facebook’s short-term profitability. He concludes, “because tracking still allows Facebook's algorithms to optimize for conversions, Facebook will still succeed.”

What about Apple’s advertising platform? “Where do they even serve ads?” Craig commented. Of course he knows, but point taken. Different business models.

Remember, if you are using a Facebook app, you are logged in. They know who you are, who your friends are, what groups you belong to and what other Facebook services you use (Instagram, WhatsApp, for example). They share this data.

My Prediction

I agree with Craig, Facebook will take a short term profit hit but will adapt and continue to make enormous profits. Small and medium size businesses will adapt, as they always have. Many business owners I speak to who advertise on Facebook appreciate the amazing advertising platform but also feel Facebook and other app developers need to be more transparent.

I hope there will be a public discussion about privacy. As browsers gave more control to users over the use of cookies and Chrome has vowed to phase cookie-sharing out by the end of 2021, advertising companies like Facebook will move to even more invasive and opaque techniques like fingerprinting. I predict that as browsers and device manufacturers crack down on fingerprinting, a new thing will emerge. Then, we’ll have a discussion about that, ad infinitem.