Jun 22, 2020 8:36 PM

Apple Pushes Back Against Ad Tracking in Safari and iOS 14

At WWDC, the company detailed a litany of privacy-friendly improvements to its software.

As a company that still makes the majority of its money selling hardware, Apple is perhaps less interested in tracking and monetizing your activity than other tech giants. Over the years it has pitched this as a competitive advantage, emphasizing that its products are designed to prioritize privacy. As the company detailed in its pre-taped Worldwide Developers Conference keynote Monday, Apple will double down on data protection in its upcoming iOS 14, macOS Big Sur, and Safari releases.

The improvements largely focus on who can access and share your data, when, and why. After years of increasingly opaque innovations from social networks, marketing firms, and advertisers who all want to track and monetize your online behavior, Apple's emphasis on transparency could help users take back some control. But even a company as large and moneyed as Apple doesn't have a panacea for every privacy woe.

Going on Safari

Safari had already established its bona fides as a privacy browser as recently as 2018, when it took a strong stand against ad trackers, chiefly by making it difficult for them to "fingerprint" your device as you browse around the web. In macOS Big Sur, Safari will include a specific "Privacy Report" to break down what specifically Safari is blocking and give you more insight into which trackers are cropping up in your daily browsing.

Additionally, Apple will now support more browser extensions in Safari and make it easier to find them in the Mac App Store. But the company also seems acutely aware of the risk that rogue extensions have posed to other browsers, given the expansive permissions they often receive to access your data and view whatever you're doing online. So Safari will include granular controls that let you dictate which extensions work on which websites—that way they don't necessarily all have access to everything all the time.

Photograph: Apple

Apple also said that its privacy-focused single sign-on product "Sign in with Apple" has been used to make more than 200 million accounts since its debut at WWDC a year ago. The company is adding a feature that will make it easier for people to convert their existing online accounts into versions managed by Sign in with Apple. Apple's Safari will also start checking any passwords you store in the browser—without sharing them with Apple—and can alert you if any have been compromised in a data breach.

iOS 14 Apps on Notice

Apple's tracking controls will extend to iOS 14 more broadly as well. A version of its "Intelligent Tracking Prevention" for Safari will give iPhone and iPad users more control over clandestine tracking not just within their browser, but between apps.

"This year we wanted to help you with tracking in apps," said Katie Skinner, a user privacy software manager at Apple during the keynote. "We believe tracking should always be transparent and under your control. So moving forward, App Store policy will require apps to ask before tracking you across apps and websites owned by other companies."

In iOS 14, you'll see a prompt when an app is trying to track you across other services. You'll have the option to "Allow Tracking" or "Ask App Not to Track." It's notable that "asking" seems different from "blocking," but Apple says in its notes to developers that they will need this permission from users to conduct external tracking. An Apple spokesperson specifically told WIRED that if a user doesn't consent to tracking, the app won't be able to access a type of identifier often used in targeted advertising and other tracking called the IDFA identifier. This would likely be similar to invoking the existing iOS feature "Limit Ad Tracking," which zeros out a user's IDFA number, but doesn't preclude tracking with other identifiers.

Apple lists two exceptions through which an app can track a user without permission: when an app is sharing data locally on a user's device with another app but never leaves the device in an identifying way, and when the data will be used for fraud detection and prevention or other security protections.

While any step toward reducing inter-app tracking is significant, the new framework likely won't resolve the problem of online tracking overnight.

"It’s an improvement, but I'm unsure how well it will actually work," says Will Strafach, an iOS security researcher and creator of the Guardian Firewall app for iOS. "I can tell you now, bad actors will run wild with the 'not sent off the device in a way that can identify the user or device' caveat. Tracking companies have hidden behind that excuse for years. Unless Apple suddenly gets a whole lot more aggressive about how they screen apps, this will only be helpful when developers are willing to be honest."

A similar issue comes up with another new privacy feature. In an attempt to make it more clear what data an app will collect, Apple will add a tailored breakdown on App Store product pages that lists different privacy considerations. Developers will need to detail which types of data the app collects and whether it will be connected to a user's identity for tracking. Developers will also have to spell out the third-party software development kits and other modules incorporated into their apps, what those components do, what data they collect, and how it will be used. On Monday, Apple compared these charts to nutrition labels, an approach to sharing transparent security and privacy information that some researchers have found effective. But developers will self-report what data they're collecting and whether there is any tracking going on in their apps, a major limitation of the labels if developers aren't fully candid.

Other changes are more concrete, though. Beginning with iOS 14, you'll see an indicator in the status bar when an app is using your device's microphone or camera, much like the green light that goes on when a MacBook's built-in webcam is in use. And you'll be able to share an approximate location with apps, within about 10 miles, rather than giving away more precise data. This way apps can pinpoint you down to the city you're in rather than the block.

You can already cobble together some of the privacy protections Apple announced on Monday through other operating systems and browsers. But it's still a challenge to get everything together in one place. With these and other cumulative improvements, Apple seems determined to make a bid for the most privacy-friendly offerings out there.