Goodbye Tracking? Impact of iOS App Tracking Transparency and Privacy Labels

Abstract

Tracking is a highly privacy-invasive data collection practice that has been ubiquitous in mobile apps for many years due to its role in supporting advertising-based revenue models. In defence of user privacy, Apple introduced two significant changes with iOS 14: App Tracking Transparency (ATT), a mandatory opt-in system for enabling tracking on iOS, and Privacy Nutrition Labels, which disclose what kinds of data each app processes. So far, the impact of these changes on individual privacy and control has not been well understood. This paper addresses this gap by analysing two versions of 1,759 iOS apps from the UK App Store: one version from before iOS 14 and one that has been updated to comply with the new rules.We find that Apple's new policies, as promised, prevent the collection of the Identifier for Advertisers (IDFA), an identifier used to facilitate cross-app user tracking. Smaller data brokers, who used to engage in some of the most invasive data practices, will now face higher challenges in tracking users -a positive development for privacy. However, the number of tracking libraries has -on average -roughly stayed the same in the studied apps. Many apps still collect device information that can be used to track users at a group level (cohort tracking) or identify individuals probabilistically (fingerprinting). We find real-world evidence of apps computing and agreeing on a fingerprinting-derived identifier through the use of server-side code, thereby violating Apple's policies and exposing the limits of what ATT can do against tracking on iOS. This is especially concerning because we explicitly refused opt-in to tracking in our study, and consent is a legal requirement for tracking under EU and UK data protection law. We find that Apple itself engages in some forms of tracking and exempts invasive data practices like first-party tracking and credit scoring from its new rules. For example, Apple regularly collects the UDID (an identifier that has been inaccessible to other companies since 2013) and the device serial number (which is an identifier printed on the box of every Apple device and allows Apple to track the life cycle of Apple devices accurately). We also find that the new Privacy Nutrition Labels are sometimes inaccurate and misleading, especially in less popular apps.

The Overview of Privacy Labels and their Compatibility with Privacy Policies

“…We also find that 42% of apps report that they do not collect any data from users. Recent works [29,30] analyzing iOS apps have found that at least 80% of the apps still use tracking libraries in the apps. Further, these libraries have been shown to collect user data [11,32].…”