Read Apple’s promise to introduce privacy features Facebook opposes (updated)

by Jonny Evans · Published November 19, 2020 · Updated November 20, 2020

The iOS 14 App Privacy diet

Apple is completely committed to creating privacy-forward features across all its products, the company has said.

It is also committed to advocate for privacy-forward changes across the technology industry, the company said in its response to civil society organizations concerned at the delayed introduction of a new privacy requirement for App Store apps to request express permission before tracking users.

The company remains resolute i its belief that “privacy is a fundamental human right.”

It continues to design all its products with this in mind. Apple’s four Privacy Pillars are: Data Minimization; On-Device Processing; Transparency; Choice, and Security.

UPDATE: Facebook subsequently issued a statement in response to Apple’s moves. You can read this here.

What is this about?

Apple at WWDC announced that it intended to require that all apps developers request permission from users before they began tracking them, it’s a feature it calls App Tracking Transparency (ATT) permissions, but it subsequently delayed introduction into early 2021.

The decision to delay caused some of the world’s biggest privacy advocates to speak out, including:

Access Now, Amnesty International, the Electronic Frontier Foundation, Human Rights Watch, the National Hispanic Media Coalition, New America’s Open Technology Institute, Open MIC (Open Media and Information Companies Initiative) and Ranking Digital Rights.

Here is the letter they sent when Apple announced the delay.

The company has now responded and you can read its response in full below.

What is ATT?

Quite simply, ATT gives people the chance to find out what data firms are collecting about them, and to make those firms openly request permission to do so.

The way this permission request and assent process is also important, as it represents a clear signal of what user’s want from apps, which underlines the egregiousness of those developers who use clever workarounds to undermine Apple’s privacy protection.

After all, this argument goes, if a user gives permission that’s fine, but if they don’t provide such assent then the company concerned should honor that.

And it also presents what could become an actionable entity.

There have been lots of arguments against Apple’s move to protect people’s privacy against such surveillance capitalism, but it is worth noting that it is only the world’s largest companies who possess the kind of data mountains that let them really use such information. This gives them an even vaster market advantage.

Apple’s letter points out:

“What some companies call “personalized experiences” are often veiled attempts to gather as much data as possible about individuals, build extensive profiles on them, and then monetize those profiles.”

Apple faced pushback

Apple decided to delay the move into 2021, arguing that developers needed more time in which to reach this and several other privacy changes it introduced in its systems.

This caused great concern across pro-privacy advocates, who wrote to Apple to argue that Apple should introduce them faster. It did not, but it has now published the following response to those requests.

The TLDR summary (incomplete, you really should read the letter for yourself):

Introduction of this feature was only to give developers time to prepare.
Apple is not against advertising, but it wants to put consumers in control.
Advertising that respects privacy is possible and existed before the Internet.
Apple respects its own rules on this.It does not access user data from its services, for example.
Any ads it places do not drill down to smaller than 5,000 person segments (?)

Apple is committed:

“To create privacy-forward features across our products — and to advocate for privacy-forward changes across the technology industry.”

What Apple said:

The letter is signed by Jane C. Horvath, who is Apple’s Senior Director, Global Privacy.

“We appreciate your support for the App Tracking Transparency (ATT) permission feature that Apple announced in June 2020 at WWDC. We also share your deep belief in the val-ues of privacy, security and transparency that inspire it, and we wanted to take time to share a bit about our approach to helping users make informed choices about their data.

“Apple believes that privacy is a fundamental human right. We design our products from the ground up to protect user privacy and security as a first principle, governed by our four Privacy Pillars: Data Minimization, On-Device Processing, Transparency and Choice, and Security. Year after year, we have introduced industry-leading privacy features and technologies designed to help our users stay in full control of their data and to help them stay one step ahead of those who seek to maximize access to personal information for private gain. In addition to ATT, for instance, we are excited to be launching our new app privacy information section on the App Store next month. We’re proud of the way these features push the entire industry forward.

“We delayed the release of ATT to early next year to give developers the time they indicated they needed to properly update their systems and data practices, but we remain fully committed to ATT and to our expansive approach to privacy protections. We developed ATT for a single reason: because we share your concerns about users being tracked without their consent and the bundling and reselling of data by advertising networks and data brokers.

“Too often, information is collected about you on an app or website owned by one company and combined with information collected separately by other companies for targeted advertisements and advertising measurement. Sometimes your data is even aggregated and resold by data brokers, which are third parties you neither know nor interact with. Tracking can be invasive, even creepy, and more often than not it takes place without meaningful user awareness or consent. What some companies call “personalized experiences” are often veiled attempts to gather as much data as possible about individuals, build extensive profiles on them, and then monetize those profiles. We are not against advertising, we simply think tracking should be transparent and under user control, which will engender user trust that will benefit all.

“We pioneered giving users more control over tracking when Safari became the first browser to block third-party cookies by default as far back as 2005. Since then, in iOS 11 and macOS High Sierra, Safari added Intelligent Tracking Prevention to further limit tracking while still enabling websites to function normally. In 2017, as now, companies that benefitted from the status quo said our privacy-forward approach would “sabotage the economic model for the Internet.” That has not come to pass — in fact, the internet advertising industry has seen revenue increases every year from 2010 to 2019, including the years following the release of Intelligent Tracking Prevention. Users simply have greater control.

“Now, we want to bring this same user-focused, privacy-forward approach to the apps customers use every day. ATT doesn’t ban the reasonable collection of user data for app functionality or even for advertising. Just as with the other data-access permissions we have added over many software releases, developers will be able to explain why they want to track users both before the ATT prompt is shown and in the prompt itself. At that point, users will have the freedom to make their own choice about whether to proceed. This privacy innovation empowers consumers — not Apple — by simply making it clear what their options are, and giving them the information and power to choose.

“There are a few more important things to keep in mind about ATT.

“Advertising that respects privacy is not only possible, it was the standard until the growth of the Internet.

“ Some companies that would prefer ATT is never implemented have said that this policy uniquely burdens small businesses by restricting advertising options, but in fact, the current data arms race primarily benefits big businesses with big data sets. Privacy-focused ad networks were the universal standard in advertising before the practice of unfettered data collection began over the last decade or so. Our hope is that increasing user demands for privacy and security, as well as changes like ATT, will make these privacy-forward advertising standards robust once more.

“ATT applies to all developers equally, including Apple, and Apple does not track its users.

“Apple has built its ads business with privacy firmly in mind. Apple does not access user data from other Apple services like Apple Pay, Maps, Siri, iMessage, and iCloud to serve ads in the App Store, Apple News, and Stocks. Nor does Apple use data from user devices through services and functions such as the Health app, HomeKit, email, contacts, or call history.

“Apple’s approach to targeted ads, in fact, demonstrates that privacy-forward advertising is possible by putting user control at the center. We don’t track our users, and they can choose to disable ad personalization based on Apple’s first-party data in Settings. They can also view the information used to deliver ads by selecting View Ad Targeting Information.

“When users have Personalized Ads on, we target ads by grouping together users who share similar characteristics such as apps downloaded, age, country or city of residence, and gender into segments, so that a given campaign or set of campaigns can’t identify a given user.

“No sensitive data is used to place users in such segments, and ads are only delivered if more than 5,000 people meet the targeting criteria. Apple does not access or use the IDFA on a user’s device for any purpose. Apple does not know what ads an individual user received. Similarly, we have set strict standards with regard to data brokers and collection of third party data. Apple does not send or receive any data from third parties to create the segments it uses to target ads. Apple engages in privacy preserving first party advertising and doesn’t append or gather data from third party sources. We simply do not need or want to gobble up more and more data in order to deliver an experience that users appreciate.

“By contrast, Facebook and others have a very different approach to targeting. Not only do they allow the grouping of users into smaller segments, they use detailed data about online browsing activity to target ads. Facebook executives have made clear their intent is to collect as much data as possible across both first and third party products to develop and monetize detailed profiles of their users, and this disregard for user privacy continues to expand to include more of their products.

“We share your belief that customers should have control over their data. The ATT permission is another proof point of our principled dedication to privacy innovations, and is no different than the other iOS-based permissions that allow a user to control access by a developer to their photos, contacts, calendar and location. And so, we see the update to iOS 14 which implements the ATT feature as a natural evolution, providing the same explicit, privacy-forward choices to our users regarding tracking by their apps as we do to other key features of the device.

“We are grateful for your leadership as we look forward to implementing the ATT framework. And we commit to continue to create privacy-forward features across our products — and to advocate for privacy-forward changes across the technology industry.”