{"id":33777,"date":"2021-09-29T16:59:32","date_gmt":"2021-09-29T20:59:32","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=33777"},"modified":"2021-09-29T16:59:32","modified_gmt":"2021-09-29T20:59:32","slug":"app-tracking-transparency-doesnt-stop-trackers","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2021\/09\/29\/app-tracking-transparency-doesnt-stop-trackers\/","title":{"rendered":"App Tracking Transparency Doesn’t Stop Trackers"},"content":{"rendered":"

Johnny Lin and Sean Halloran<\/a>:<\/p>\n

\n

Using the open source Lockdown Privacy app and manual testing, we found that App Tracking Transparency made no difference in the total number of active third-party trackers, and had a minimal impact on the total number of third-party tracking connection attempts. We further confirmed that detailed personal or device data was being sent to trackers in almost all cases. ATT was functionally useless in stopping third-party tracking, even when users explicitly choose “Ask App Not To Track”.<\/p>\n

[…]<\/p>\n

How could Apple have failed so miserably in stopping third party trackers with a feature named “App Tracking Transparency”? Digging into the answers for this question led us to discover the main cause: Apple’s narrow definition of the term “tracking”.<\/p>\n

[…]<\/p>\n

Instead, Apple has hijacked the term “tracking” to define it as something highly specific, and they’ve even placed their full definition of it in developer documentation, which of course no average iOS user will ever read. […] Based on our research, we found Apple’s definition of tracking to be misleading, counterintuitive, and confusing for these reasons[…]<\/p>\n

[…]<\/p>\n

Not only do these trackers allow<\/em> their clients to break Apple’s rules, but they specifically built features to help their clients easily circumvent Apple’s ATT privacy rules.<\/p>\n<\/blockquote>\n\n

Nick Heer<\/a>:<\/p>\n

The disconnect in these findings may be explained by the many apps that are following the rules, particularly those from smaller or independent developers — who cannot afford to incur the wrath of App Review — and from really big developers where it would be obvious if they did not comply. In the middle lies this assortment of apps not quite notable enough to attract attention — at least, until this study came out.<\/p>\n

[…]<\/p>\n

That aside, I do think the similarities between other permission prompts and the one for app tracking could be misleading. I do not think this is deliberate. But I can see how many people could view their effects similarly, even though the negative option is to “ask” for the app to comply with the user’s request instead of simply disallowing permission.<\/p><\/blockquote>\n\n

Matt Wille<\/a>:<\/p>\n

The investigation found at least three iPhone games — popular enough to make it to the top of the App Store charts — sending explicit user data to third-party advertising companies, even after the user has selected the option for their information not to be collected. And Apple has done nothing about those apps’ invasive methods, despite being alerted to them weeks ago.<\/p><\/blockquote>\n\n

Previously:<\/p>\n