Max Schrems is back... and he's challenging Apple's 'secret iPhone advertising tracking cookies' in Europe
- Reference: 1605592993
- News link: https://www.theregister.co.uk/2020/11/17/schrems_apple_cookies/
- Source link:
His digital rights group Noyb has targeted the tech giant in Germany and Spain, [1]claiming Cupertino's “Identifier for Advertisers” (IDFA) tracking ID, which is automatically generated on every iPhone during setup, allows Apple, app makers and ad networks to follow an individual user's activities and use that data to show them ads targeted at their interests.
Here's Noyb's gist of its own complaint:
Each iPhone runs on Apple’s iOS operating system. By default, iOS automatically generates a unique “IDFA” (short for Identifier for Advertisers) for each iPhone. Just like a license plate this unique string of numbers and characters allows Apple and other third parties to identify users across applications and even connect online and mobile behaviour (“cross device tracking”).
Apple’s operating system creates the IDFA without user’s knowledge or consent. After its creation, Apple and third parties (e.g. applications providers and advertisers) can access the IDFA to track users’ behaviour, elaborate consumption preferences and provide personalised advertising.
Schrems has a track record of winning against tech giants, most famously forcing the collapse not once, [2]but twice , of the transatlantic Privacy Shield data-sharing agreement between the European Union and the United States by focusing on Facebook’s data policies.
In this particular case, Noyb argues Apple's IDFA effectively acts like a cookie, and so requires a user’s consent under European law – and yet the tech giant creates the ID code in secret. As such, the team reckons Apple breaks the EU’s 2002 e-Privacy Directive aka “ [3]Cookie Law ” and Article 5(3) which it says “requires informed and unambiguous consent from users to store their data.”
The [4]complaint [PDF] states that “in practice, the IDFA is like a ‘digital license plate.’ Every action of the user can be linked to the ‘license plate’ and used to build a rich profile about the user. Such profile can later be used to target personalised advertisements, in-app purchases, promotions etc. When compared to traditional internet tracking IDs, the IDFA is simply a ‘tracking ID in a mobile phone’ instead of a tracking ID in a browser cookie.”
In recent years, Apple has made big play out of its approach to privacy, pointing out repeatedly that, unlike, say, Facebook and Google, it does not seek to gather as much information on users as possible so it can then sell access to advertisers. But, according to Noyb, Apple is effectively doing exactly that by tracking users across applications using the IDFA, and even connecting the ID with online and mobile behavior.
Data breach
“EU law protects our devices from external tracking. Tracking is only allowed if users explicitly consent to it. This very simple rule applies regardless of the tracking technology used,” said Noyb’s privacy lawyer Stefano Rossetti. “While Apple introduced functions in their browser to block cookies, it places similar codes in its phones, without any consent by the user. This is a clear breach of EU privacy laws.”
The complaint provides an exchange between Noyb and Apple back in February in which the privacy group asked for information about IDFA, and Apple claimed that consent is not required from users for its installation because it is randomly generated and not associated with Apple’s own ID system, Apple ID.
But Noyb took issue with that characterization, noting that the IDFA will be shared with several apps, and with Facebook, and so became linked to private information. “I believe this pseudoanonymous identifier is private data under GDPR precisely because it can be tied to me personally,” Noyb quoted a complainant, whose name is redacted, in the case as saying.
Apple: Yeah, about those ground-breaking privacy features in iOS 14 – don't expect them until next year [5]READ MORE
Apple replied to that response by stating it was “not in a position to comment on how a third party may handle such matters,” and then followed its usual rule book: it went silent and failed to respond to all subsequent communication.
Four months later, in June, Apple announced it was going to cut off guaranteed third-party access to IDFA. The announcement sparked horror in the online advertising industry, and Facebook even [6]publicly griped about it. One week later, Apple [7]announced it was delaying the changes, which would require permission from users before their devices would use the IDFA system.
'Factually inaccurate'
Apple responded briefly to the complaint on Monday, saying the claims were "factually inaccurate and we look forward to making that clear to privacy regulators should they examine the complaint."
Apple has good reason to be worried, however. Since Noyb claims the code breaks the e-Privacy Directive, rather than, say, GDPR, European governments can directly fine the iPhone maker if they finds it has broken the law.
Even if/when Apple does implement the changes it highlighted in August, it is still insufficient, Noyb argues in its complaint. “These changes seem to restrict the use of the IDFA for third parties (but not for Apple itself),” it said. “However, the initial storage of the IDFA and Apple’s use of it will still be done without the users’ consent and therefore in breach of EU law.” It argues that the IDFA shouldn’t be restricted but permanently deleted.
The advertising industry has also recognized the threat posed by the complaint, and has started arguing that folks should be given an opt-out option to being tracked, and that such code should not be removed.
COO of adtech company TrafficGuard, Luke Taylor, noted: "As an advertising industry, we’ve done a very poor job of communicating to the end user as to why we’re tracking them, and why this is beneficial... Few consumers understand how any of this works, and with lack of understanding it’s simple to just say no and block it. Importantly though, they should have the option to be able to opt-out.
"Many people think of ‘advertisers’ as big headless corporations and digital advertising as this sinister dark art. But it is an ecosystem and businesses of all sizes depend on online advertising to reach consumers." ®
Get our [8]Tech Resources
[1] https://noyb.eu/en/noyb-files-complaints-against-apples-tracking-code-idfa
[2] https://www.theregister.com/2019/10/23/third_review_of_privacy_shield_room_for_improvement/
[3] https://www.theregister.com/2017/10/26/eu_lawmakers_move_closer_to_new_cookie_law_after_parliamentary_battle/
[4] https://noyb.eu/sites/default/files/2020-11/IDFA_Germany_DEF_Redacted.pdf
[5] https://www.theregister.com/2020/09/03/apple_ios14_privacy/
[6] https://www.theregister.com/2020/08/27/facebook_ios_ads/
[7] https://www.theregister.com/2020/09/03/apple_ios14_privacy/
[8] https://whitepapers.theregister.com/
Re: They just don't get it.
Why would anyone want any company to profile them for ANY reason?
Re: They just don't get it.
I remember clicking on a "don't track me" button somewhere, and as a last-ditch effort, the website showed a message on the lines of: "Are you sure? We're going to show you ads anyway, we might as well try to show you something you're interested in instead of random crap"
Re: They just don't get it.
I had one of those recently. My experience of targeted advertising is throwing ads at me to buy more of the long lasting consumer durable I have just purchased. It’s witless.
Just like predictive text. I’ve had my phone for about 4years now and it still can’t predict what I’m going to type. Some of the suggestions are not just laughable they are utterly ungrammatical. The correct part of speech for what precedes is the LAST option which comes up when I just have one more character to type.
I only allow suggestions in the bar below, I cannot handle words writhing on the screen as I’m trying to type them and don’t get me started on autocorrect in places you can’t turn it off. Messages I get from family and others with autocorrected mistakes just confirm me in this.
The algorithms are clearly still a work in progress. Wake me up when they work properly and can cope with someone who actually has a good vocabulary and knows how to use it.
This stuff is still very much a work in progress.
Targetted advertising
It's never of any interest / relevance to me, which may show that the information I "leak" is of so low quality that they can't find anything in it of any use.
Or the algorithms are just useless.
Re: They just don't get it.
Because most people don't appear to care and are happy to trade their privacy for a free Starbucks or a new chat app.
Remember, we're not the 'normal' attitude.
Re: They just don't get it.
But they failed to explain "why this is beneficial" - forgetting to explain for whom. I'm sure it's extremely beneficial for their pockets, not beneficial at all for those who are tracked - since the very reason to do that is being able to extract as much money as possible from their pockets, when not something worse.
If they can explain why it's beneficial, it should also be simple to make it to be opt-in, right? People will see the benefits and will opt in in droves, right?
Re: They just don't get it.
Exactly. The law says opt-in. If you are not giving them the choice or you are offering opt-out, you are breaking the law. Simples.
Re: They just don't get it.
I find a nice irony in the fact that the biggest suckers to buy a product as a result of advertising hype, are advertisers themselves.
I doubt that targetted ads are ultimately any better than good advertising in general, the companies who benefit most from targetted advertising are those who sell it.
Re: They just don't get it.
"As an advertising industry, we’ve done a very poor job of communicating to the end user as to why we’re tracking them, and why this is beneficial."
Let me have a go - it's beneficial (to the advertiser) because it allows them to make more money by using personal data to profile individuals and target advertising at them.
The problem is, that if you explain this to the "end user", who in this case, is the person about whom you are collecting personal information, they are, quite rightly, going to want you to get their consent first, and if they do understand what you're up to, they won't consent. If your whole business model is based on doing stuff behind people's backs and hoping they won't notice, I'm going to push the boat out here and suggest that maybe you shouldn't be in business.
Yes but
No but yes but no. Makes perfect sense
Gotta love this dude
I have no idea who this guy is in real life but he definitely has a King Kong sized pair. ( insert your own definition of a pair )..
Max is punching them where it hurts and they apparently don't have a leg to stand on without making fools of themselves...
Three cheers for Max.
What we need is a new cookie monster.
Not one that eats cookies but one that eats just enough of them to make them taste really bad with apple sauce.
Other evil empires exist.
Can it be bad to totally screw up their advertising targeting?
It's this...
Dear advertising industry, it's this sort of bollocks below that makes us all feel as though you are a lower form of life than pond scum...
"As an advertising industry, we’ve done a very poor job of communicating to the end user as to why we’re tracking them, and why this is beneficial... Few consumers understand how any of this works, and with lack of understanding it’s simple to just say no and block it. Importantly though, they should have the option to be able to opt-out."
1. Please explain who it is beneficial to. It is certainly not beneficial to me and I will continue to block all ads using all tools available.
2. The reason few consumers understand it is because it has been designed to be as opaque as possible.
3. I'd like to point out that I should have the option to opt-in. Not that I would.
Thanks.
Re: It's this...
Dear advertising industry, it's this sort of bollocks below that makes us all feel as though you are a lower form of life than pond scum
Pond scum is just the relatively benign stuff that floats to the top. They're the stinking oozing stagnant mud at the bottom of the pond, where the crawling and writhing things live.
Just say no
I have a longstanding policy NEVER to buy goods or services from ads intruding where I don’t want them. Take that advertising industry. I HATE ads, take steps not to see them and regard ads as reasons NOT to buy things. I’m capable of doing research before buying things and even if triggered to look by an ad I am not going to take your word for it.
So just sling dough at Google searches so I’ll see your site. Though I’m very price conscious at the moment so if you aren’t cheap, sorry, no sale.
I purposely wipe out all traces of local storage, cookies, browsing history, ... before I go shopping just to prevent the industry trying to leverage anything aabout me in the prices of goods. It's really interesting the change that makes in the prices I see. I'd definitely not shop using an Apple device given the existence of this identifier.
Wasting their time
I do wonder what the advertisers would make of me. I'm not that knowledgable about data privacy but seem to avoid most targeted ads - I don't use my phone to buy stuff and was able to turn a lot of the google stuff off. On my comps I use Brave as my preferred browser and rarely see ads - if any - for stuff even vaguely interesting to me - maybe I'm going to the wrong (or right) sites?
I think the advertising world is wasting a lot of money and doing it all wrong - or maybe it works for the 98% of the population who would happily click 'Kill my children' to get a pop up banner out of the way.
Maybe not being on facebook, twitter etc helps.
95% Don't Care
Came across some consent stats recently and 95% of users simply click the Agree button. No one can be bothered going layers deep to adjust settings which are rarely GDPR compliant anyways...
Re: 95% Don't Care
Which is exactly why it should be clearly, and explicitly opt in. And that doesn't mean with one giant "yes" button, and a tiny grey link to a page where you can click the no button after scrolling through pages of text.
> Few consumers understand how any of this works, and with lack of understanding it’s simple to just say no and block it.
And with understanding it becomes necessary to say "HELL NO!" and block it.
This is what I do. I don't like the idea of ads being thrown at me left, right and centre even more than I don't like the idea of being tracked across all of space and time. I try my best to contribute to the content I consume on a regular basis, but ad networks are flat-out blocked.
Some sites have fallen back on an old form of advertising, where they directly negotiate with the advertiser and place a banner or link directly on their site. By and large, I don't have a problem with this. The adverts are usually more reserved in how they are implemented and some effort has usually been taken to integrate them into the site in a sensible way. These ads usually slip through an ad-blocker's net and for the time being I'm happy for that to continue.
On the other end of the spectrum, we have sites that refuse to show anything if you've got an ad-blocker. Which to me, as a web developer, is just cute.
First, I don't like Advertising tracking. TBH, I don't really believe it benefits the consumer. I know that theoretically, the tracking allows the advertisers to try and sell you stuff you might want, but guess what? It rarely works, and if I am looking to buy something, I'm more than capable of searching for it it myself. Where I do allow tracking, the ads, more often that not, try and sell me another of an item I have just bought or searched for. They ignore the fact that if I want or need more than one of an item when I buy it, I will buy more than one. They also ignore the fact that just because I am searching for an item does not mean I am planning (or even able) to purchase that item. Thus presenting hundreds of ads for similar items isn't likely to persuade me to buy one of them.
However, I don't block the adverts. Why? Because I run a small forum site. We have a couple of thousand users, and while I don't handle the finances, I know that the Google ads on the site pay for the site's costs, with a tiny profit (about £100 a year). There are a lot of small sites financed like this, and if I use one, I don't want to deprive the site owner of potentially much needed income. I do, however, ignore the ads. Even the big sites have costs
They just don't get it.
"As an advertising industry, we’ve done a very poor job of communicating to the end user as to why we’re tracking them..... , they should have the option to be able to opt-out"
Try this instead
"they should have the option to be able to OPT-IN"
See, easy.