Apple’s Best iPhone Privacy Feature Has A Surprising Problem

The headlines have painted Apple as a hero, with its App Tracking Transparency (ATT) iPhone feature introduced in iOS 14.5 beating Facebook by halting its ability to track people across other apps and websites. 

But the tone been changing of late as people realize the surprising problem with Apple’s best iPhone privacy feature—it doesn’t stop all tracking, and it’s open to interpretation. That’s the subject of a new report in respected U.K. newspaper the Financial Times, which says Apple is letting the likes of Snapchat and Facebook get away with some tracking of iPhone users. 

What does Apple’s ATT feature do?

When an iPhone user says no to tracking, Apple specifically takes away the identifier for advertisers (IDFA) from the developer. Apple is able to perform this task on a technical level by revoking access to the unique number that identifies your specific iPhone, and replacing it with a string of zeros. 

But app makers are still acquiring user level data that’s anonymized and aggregated with other devices, MacRumors points out. This doesn’t tie the data to a specific iPhone. The FT calls it “an unacknowledged shift that lets companies follow a much looser interpretation of its controversial privacy policy.”

Apple’s website says it is not considered tracking “when the data is linked solely on the end-user’s device and is not sent off the device in a way that can identify the end-user or device.”

But some developers’ interpretation of this, according to the FT, is that “signals” and behaviors from groups of people can still be observed, and these groups can then be shown tailored ads.

Does this actually break Apple’s anti-tracking rules?

So does this break Apple’s ATT rules? It’s open to interpretation, which is the issue, but some experts say yes.

Analyst Eric Seufert says on Twitter that the issue the FT describes does in fact violate Apple’s ATT rules. “If user-level click/install attribution is happening *at all* with the IP address, then that violates ATT. This is especially true if that data changes hands between 1st/3rd party companies,” he wrote in a tweet.

Seufert adds that “using an IP address to identify a user for attribution, even if that user’s data is only reported at a campaign level, very much qualifies as deriving data from a device for the purpose of uniquely identifying it.” 

“The altitude of later aggregation of that data is irrelevant,” he says.

ATT is a great start, but not a catch-all

As I have explained in the past, Apple’s App Tracking Transparency is a great start, and it’s certainly impacted Facebook’s ability to track the effectiveness of ad campaigns. Without the IDFA, Facebook can’t see when a specific person has viewed an ad on Facebook, Googled the company and clicked on the website. 

But of course there are caveats. It’s not the first time ATT has been criticized—a report in the Washington Post called the iPhone privacy feature “functionally useless.” 

From the outside, it seems that Apple is being a little hands off in policing the feature, but it’s also important to note that ATT is still very new, and developers are still adjusting to what the more privacy-focused iPhone landscape will look like. Others may deliberately try to circumvent the ATT rules.

The iPhone maker does not allow fingerprinting—a way of uniquely identifying a user— but some app makers have already been trying to get around this if reports are to be believed. 

In response to this story, Apple sent me a statement over email, which reads: “A user’s data belongs to them and they should get to decide whether to share their data and with whom.

“With iOS and iPad OS we have given users the choice whether or not they want to allow apps to track them across apps and websites owned by other companies. These rules apply equally to all developers—including Apple—and we have received strong support from regulators and privacy advocates for this new feature.”

Take control of your iPhone to stop tracking

So in the end, it’s down to you to take steps to improve privacy on your iPhone, and be aware of the limitations of ATT. Jake Moore, a cybersecurity specialist at ESET, advises people “to try and hold back on as much data as possible.”

“Facebook and other companies are desperate to analyze your data in ways that can be turned into profit. However, the waters are muddied when people opt out of tracking services and they continue to be spied upon without their knowledge. They may not be able to know who you are exactly, but they are able to learn specific data points from other information sent across.”

You can also use an iPhone app such as Lockdown Privacy to view and block additional trackers. Be careful of app permissions, and take advantage of the soon-to-launch features in iOS 15.2, such as the App Privacy Report, which gives you more insight into this. 

It’s important to be on your guard. In today’s complex privacy landscape, it’s down to us to ensure our iPhones our secure and private, and take the additional steps to do so.