Apple's 'Do Not Track' Button Is Privacy Theater

from the privacy-theater-incorporated dept

Earlier this year Apple received ample coverage about how the company was making privacy easier for its customers by introducing a new, simple, tracking opt-out button for users as part of an iOS 14.5 update. Early press reports heavily hyped the concept, which purportedly gave consumers control of which apps were able to collect and monetize user data or track user behavior across the internet. Advertisers (most notably Facebook) cried like a disappointed toddler at Christmas, given the obvious fact that giving users more control over data collection and monetization, means less money for them.

By September researchers had begun to notice that Apple's opt-out system was somewhat performative anyway. The underlying system only really blocked app makers from accessing one bit of data: your phone's ID for Advertisers, or IDFA. There were numerous ways for app makers to track users anyway, so they quickly got to work doing exactly that, collecting information on everything from your IP address and battery charge and volume levels, to remaining device storage, metrics that can be helpful in building personalized profiles of each and every Apple user.

Privacy advocates and the press noted how this was all giving Apple users a false sense of security without really fixing much. Privacy experts and press outlets also repeatedly informed Apple this was happening, but nothing changed. In fact, the Financial Times notes that six months after the feature was introduced, Apple has further softened its stance on the whole effort:

"But seven months later, companies including Snap and Facebook have been allowed to keep sharing user-level signals from iPhones, as long as that data is anonymised and aggregated rather than tied to specific user profiles.

Here's the thing. There's been just an absolute torrent of studies showing how "anonymizing" data is a gibberish term. It only takes a few additional snippets of data to identify "anonymized" users, yet the term is still thrown around by companies as a sort of "get out of jail free" card when it comes to not respecting user privacy. There's an absolute ocean of data floating around the data broker space that comes from apps, OS makers, hardware vendors, and telecoms, and "anonymizing" data doesn't really stop any of them from building detailed profiles on you.

Apple's opt-out button is largely decorative, helping the company brand itself as hyper privacy conscious without actually doing the heavy lifting required of such a shift:

"Lockdown Privacy, an app that blocks ad trackers, has called Apple’s policy “functionally useless in stopping third-party tracking”. It performed a variety of tests on top apps and observed that personal data and device information is still “being sent to trackers in almost all cases."

A lot of folks spend a lot of time trying to tap dance around a fundamental truth: any effort to give consumers more control and clear insight over what's being collected or sold reduces revenues by billions of dollars annually, even if only a fraction of existing users take advantage. And nobody with their face buried deep in the data monetization trough wants that. It's why it's 2021 and the U.S. still doesn't even have a basic, clear privacy law for the internet era. Not even a super clean one mandating basic transparency requirements and working opt-out tools.

So what we get instead is a lot of gibberish and privacy theater by a lot of folks who don't want to take even a tiny hit in revenues in exchange for healthier markets and happier users.

We also get just an endless parade of semantics, like ISP claims they "don't sell access to your data" (no, they just give massive "anonymized" datasets away for free as part of a nebulous, broader arrangement they do get paid for). We get tracking opt-out tools that don't actually opt you out of tracking, or opt you back in any time changes are made. And we get endless proclamations about how everybody supports codifying federal privacy laws from companies that immediately turn around and spend millions of dollars lobbying to ensure even a basic privacy law never sees the light of day.

At some point this combination of feckless oversight, rampant overcollection of data, minimal transparency, and repeated failure to adhere to the basics on data security will result in a privacy scandal that makes the last fives years' worth of scandals look like a grade school picnic. When that happens, we might finally see some traction on at least a basic law that mandates transparency, opt-out tools that actually work, and penalties for lax security. Until that momentum shift happens, the majority of "privacy reform" efforts are going to have a high ratio of meaningless song and dance.

Filed Under: apps, data, do not track, ios, opt-in, opt-out, privacy
Companies: apple, facebook, snap

Study Shows How Android Phones Still Track Users, Even When 'Opted Out'

from the words-mean-nothing dept

We've frequently noted that what's often presented as "improved privacy" is usually privacy theater. For example researchers just got done showing how Apple's heavily hyped "do not track" button doesn't actually do what it claims to do, and numerous apps can still collect an parade of different data points on users who believe they've opted out of such collection. And Apple's considered among the better companies when it comes to privacy promises.

Android is notably worse. One of my favorite privacy and adtech reporters is Shoshana Wodinsky, because she'll genuinely focus on the actual reality, not the promises. This week she wrote about how researchers at Trinity College in Dublin took a closer look at Android privacy, only to find that the term "opting out" often means absolutely nothing:

"According to the researchers, “with little configuration” right out of the box and when left sitting idle, these devices would incessantly ping back device data to the OS’s developers and a slew of selected third parties. And what’s worse is that there’s often no way to opt out of this data-pinging, even if users want to."

So called "system" apps in many Android variants by the likes of Samsung, Xiaomi, and Huawei often come pre-installed, and can't be removed without rooting your device (which the majority of users can't or won't do). These apps are pretty constantly hoovering up handset data and sending it back not only to the parent company, but to third party data brokers. So even when you think you're "opting out" of data collection and sales, you're not really:

"On their own, none of these data points can identify your phone as uniquely yours, but taken together, they form a unique “fingerprint” that can be used to track your device, even if you try to opt out. The researchers point out that while Android’s advertising ID is technically resettable, the fact that apps are usually getting it bundled with more permanent identifiers means that these apps—and whatever third parties they’re working with—will know who you are anyway. The researchers found this was the case with some of the other resettable IDs offered by Samsung, Xiaomi, Realme, and Huawei."

Some of Google's developer rules prohibit the worst sorts of behavior, but they often only restrict how the data can be sold, not what can be collected. And it's also hard to think they're being effectively policed at any scale. Meanwhile, Google tried to brush aside the researchers' concerns over at Bleeping Computer by claiming this is just how phones work now:

"While we appreciate the work of the researchers, we disagree that this behavior is unexpected – this is how modern smartphones work. As explained in our Google Play Services Help Center article, this data is essential for core device services such as push notifications and software updates across a diverse ecosystem of devices and software builds."

Except it's not how cell phones have to work. Case in point: phones using /e/OS, a privacy-focused open-source operating system that promises users a "de-Googled" device, don't mindlessly and endlessly chirp back to the monitor mothership. You can make devices that actually don't phone home constantly, and genuinely opt users out of all tracking when asked. Companies just don't want to do it. Most usually because apathy and tap dancing is more profitable.

Again, much of this occurs because the U.S. still lacks a real privacy law for the internet era. While people often talk about how passing a good privacy law is just too damn hard to get right, a good first step is requiring absolute transparency into what's being collected and sold, and providing working opt out tools. And also we could probably actually fund and staff U.S. privacy regulators while we're at it, so there's somebody competent actually watching the henhouse. Meanwhile, the full study can be found here (pdf) for those interested.

Filed Under: android, do not track, opt-out, privacy
Companies: google

Research Shows Apple's New Do Not Track App Button Is Privacy Theater

from the privacy-theater dept

While Apple may be attempting to make being marginally competent at privacy a marketing advantage in recent years, that hasn't always gone particularly smoothly. Case in point: the company's new "ask app not to track" button included in iOS 14.5 is supposed to provide iOS users with some protection from apps that get a little too aggressive in hoovering up your usage, location, and other data. In short, the button functions as a more obvious opt out mechanism that's supposed to let you avoid the tangled web of privacy abuses that is the adtech behavioral ad ecosystem.

But of course it's not working out all that well in practice, at least so far. A new study by the Washington Post and software maker Lockdown indicates that many app makers are just...ignoring the request entirely. In reality, Apple's function doesn't really do all that much, simply blocking app makers from accessing one bit of data: your phone's ID for Advertisers, or IDFA. But most apps have continued to track a wide swath of other usage and location data, and the overall impact on user privacy has proven to be negligible:

"Among the apps Lockdown investigated, tapping the don’t track button made no difference at all to the total number of third-party trackers the apps reached out to. And the number of times the apps attempted to send out data to these companies declined just 13 percent."

Researchers found the new system actually provided users with a false sense of security and privacy when very little had actually changed.

Even when consumers "opted out," most of the apps were still collecting data metrics like volume level, IP address, battery level, browser, cellular carrier, and a long list of other data points, allowing companies to craft elaborate profiles of individual consumers. And little to none of this is being meaningfully disclosed to actual users. Perpetually, the adtech industry tries to argue that none of this is a big deal because much of this data is "anonymized," but that's long been nonsense. Studies repeatedly show that when there are enough data points floating about in the wild, nobody on the internet is truly anonymous.

The fact gets buried in conversations on this subject, but the entire adtech tracking ecosystem, from app makers and "big tech" to telecom and every data broker in between, is a largely unaccountable mess. All operating in a country with no meaningful internet-era privacy law, and privacy regulators that intentionally have a tiny fraction of the resources and funding as their overseas contemporaries. So when you see privacy scandal after privacy scandal emerge, it's important to understand that this is a conscious policy choice driven by greed, not just some organic dysfunction that showed up one random Tuesday.

And unfortunately, so far, most of the big pronouncements by major tech giants about consumer privacy, whether it's Apple's shiny new app privacy button or Google's FLOC technology, aren't doing much to actually fix the problem. And, in some cases, they have the potential to make a bad problem worse. Actually fixing this problem would cost a whole lot of people a whole lot of money, so instead we get (waves hands around at a wide variety of privacy theater) whatever the hell this is supposed to be.

Filed Under: apps, do not track, idfa, ios, privacy, privacy theater
Companies: apple

FCC Refuses To Force Websites To Adhere To 'Do Not Track,' And That's A Good Thing

from the plate's-already-full dept

If you've followed the saga of "Do Not Track," you know it began with good intentions, labored under squabbling and marketing industry sabotage, and is now seen by some as too little too late in the face of far more sophisticated new snoopvertising technologies. Knowing that many companies will never honor Do Not Track requests voluntarily, Consumer Watchdog had filed a petition (pdf) with the FCC to "initiate a rulemaking proceeding requiring 'edge providers' (like Google, Facebook, YouTube, Pandora, Netflix, and LinkedIn) to honor 'Do Not Track' Requests from consumers."

In short, the faux consumer advocacy group (which is famous for taking extreme positions that would likely do more harm to consumers than help them) wanted the FCC to lean on Title I and Section 706 authority to regulate "information services," forcing content companies to honor DNT requests. While the FCC is planning to begin proceedings examining new privacy policies for broadband companies in the next few months, the group argued this wouldn't be enough to protect consumers from invasive snoopvertising:

"Many consumers are as concerned -- or perhaps even more worried -- about the online tracking and data collection practices of edge providers... edge providers collect the same sensitive personal information that broadband Internet access service providers collect, and that the Commission is committed to protecting. If the Commission does not act to regulate the collection of personal information by edge providers, the Commission will in effect be granting a regulatory advantage to the edge providers, implicating concerns of market distortions."

But the FCC is having none of it. The agency dismissed (pdf) Consumer Watchdog's request, stating that it "has been unequivocal in declaring that it has no intent to regulate edge providers." And indeed, the FCC already has its hands full; it's fighting off ISP lawyers trying to dismantle net neutrality and Title II reclassification, battling ISP-beholden states unhappy with the agency's attack on protectionist broadband state law, and is about to go to war with ISPs on privacy. That's a pretty full plate, with the FCC likely lacking the bandwidth for making any more "friends" at the moment.

And while some telecom industry sockpuppets will surely insist this is a double standard, the FCC's decision may not be a bad thing. The EFF argues the FCC made the "right call, for now," pointing out that consumers can choose not to use Google or Facebook, a luxury they don't enjoy when being held captive by the uncompetitive broadband last mile:

"Why the distinction between websites and ISPs? Because ISPs occupy a much more privileged position on the network. They carry all of a user’s traffic. That gives them the power to act as gatekeepers, deciding what sorts of traffic users can send and receive. It also gives them the opportunity to modify user traffic, adding privacy-destroying tags like Verizon’s UIDH super-cookie.

Edge providers, on the other hand, don’t have quite as much power. It’s a lot easier for users to “vote with their feet” and use a different edge provider for search, social networking, blogging, etc., than it is to change ISPs. Users also have more control over what information they send to edge providers -- that’s why tracker blockers like Privacy Badger work. And of course, there’s the matter of jurisdiction; while ISPs operate in specific geographical areas, websites are accessible (and hosted) all over the world, which would raise all sorts of terrible jurisdictional issues."

In other words, enforcement would be impossible even if the FCC had decided to regulate websites and stumble into the Do Not Track mess. It's a fairly restrained decision for an agency consistently accused of being power mad, and the right call for a regulator that will need every spare calorie for its mammoth battle against the broadband industry duopoly.

Filed Under: do not track, edge providers, fcc, information services, privacy, section 706, title i
Companies: consumer watchdog, google facebook

EFF Condemns Google For Circumventing Safari Privacy Protections

from the but,-i-thought-they-were-a-mouthpiece... dept

One of the common statements that we heard time and time again from SOPA/PIPA supporters in the last couple months was that all of the many civil liberties groups that worked against the bills were really "Google fronts." The key target in these attacks was almost always EFF -- a group which is pretty widely respected. It's also kind of strange, because looking over the EFF's most recent (public) financial statement (pdf), there isn't much evidence of Google support. Not only is corporate funding only about 15% of EFF's total budget, but Google isn't even listed as a company sponsor in the listing of companies which donated.

Either way, I'm curious how those who continue to insist that EFF is a Google front have to say about EFF's extremely pointed, open letter to Google for its latest privacy failure -- circumventing Safari's privacy settings for millions of users to track web browsing habits of people who specifically opted-out of such tracking.

For what it's worth, this does appear to be a pretty big screw-up on Google's part -- and knowing how quickly some Google haters assume any privacy issue is nefarious and make a big deal of it, I fully expect that Google is going to end up having to pay big time for this mistake. It's worth noting, of course, that at least three other ad companies, including giant WPP, were spotted using the same technique to get around restrictions. But since there's been so much focus on Google and privacy, Google-haters will certainly make quite a lot of noise about this particular issue.

I also absolutely agree with the EFF's statement that Google not only needs to acknowledge that it can do a better job on privacy issues, it should, in fact, be expected to do a lot more concerning privacy issues (though I'm not convinced the "Do Not Track" is really the proper solution). Google's privacy efforts often seem to lag behind its open and consumer-first focus on other issues. I think that's unfortunate.

The EFF doesn't mince words on this:

Google, the time has finally come. You need to make a pro-privacy offering to restore your users' trust.

Internet users worldwide have loved your products for years, and we've often praised your stance on free expression and transparency and your efforts to limit government access to users' information. But when it comes to consumer choice around privacy, your commitment to users has been weaker. That's bad for users, for the future of the Internet, and ultimately, for you. We need to create an Internet that gives users meaningful choice about sharing their personal data, and we need your help to do it.

It's time for a new chapter in Google's policy regarding privacy. It's time to commit to giving users a voice about tracking and then respecting those wishes.

Either way, I'm curious how those who continue to insist that EFF is merely a front group for Google respond to issues like this one -- which is probably an even more "core" issue for Google. EFF has been on the opposite side of Google on privacy issues in the past. Isn't it possible that EFF is an entirely separate organization from Google and has its own views on a variety of issues -- some of which align with Google and some of which do not? One would hope that issues like this would put to rest the silly claims that EFF's involvement in the SOPA/PIPA fights were really just about acting on behalf of Google.

Filed Under: cookies, do not track, privacy, safari, settings
Companies: eff, google

US Government Pushing Pro And Anti-Privacy Internet Rules At The Same Time

from the figure-this-one-out dept

Ah, the hypocrisy of politicians. We've pointed out in the past how often politicians seem to push for data retention laws and privacy laws at the same time, without realizing the two are in fundamental conflict. It looks like the Obama administration is going through a bit of that as well. The FTC has been threatening to force browser makers to include a do not track feature, that would let people surf without having their data retained. And yet... at the same time, the Justice Department is pushing for extensive data retention laws, with the help of the supposed "small government" Congressional reps who don't even seem to realize what they're supporting. Even worse, Congress seems so eager to push for a data retention law that some Congressional Reps are apparently annoyed that the Justice Department hasn't just handed them a bill to approve.

The problem, of course, is that these politicians don't actually fully understand what the issues are involved here. They're viewing the issues on a very narrow basis. On the "do not track" issue, they think "privacy is important, of course we support privacy -- do not track is important." On the "data retention" issue, they think "well, law enforcement needs to have access to data to solve crimes, and without requiring internet companies to retain data, then it'll make law enforcement harder, so of course we need to have data retention." What they don't recognize is that these two things are in fundamental conflict with each other. Requiring data retention means less privacy. Period. But these politicians never actually think that far.

Filed Under: data retention, do not track, privacy

FTC Wants Do-Not-Track Browser System... But Does The Government Need To Be Involved?

from the it's-called-no-script dept

So a lot of folks are talking about the FTC's new plan for a "Do Not Track" system, which would be a browser-based tool that would let people indicate that they do not want various marketing/advertising/tracking tools to track their internet surfing. While I appreciate the FTC's general concern about privacy, I'm sort of wondering why it needs to be involved at all, if the idea is to create a browser-based system for this. There are already technological tools out there to do much of what the FTC appears to want. You can disable cookies or use tools like No Script to block most tracking efforts already. So what does the FTC's push do that isn't already being done by the market?

Filed Under: browser, do not track, ftc, privacy, regulations

Now Consumer Groups Want A 'Do Not Track' List

from the and-how-would-that-work-exactly? dept

While the "Do Not Call" list in the US has mostly been successful (with some glaring exceptions) in cutting down on intrusive telemarketing calls, it has kicked off a somewhat annoying trend for consumer groups to demand all sorts of other "Do Not X" lists. Popular for a while was the idea of a "Do Not Spam" list, which most folks realized would be almost impossible to administer. Now, some consumer groups are pushing for a similar "Do Not Track" list, following all of the recent stories about behavioral marketing and clickstream tracking. This list would, its proponents claim, let people opt-out of allowing advertisers to track them. Again, though, this idea would be nearly impossible to manage in real life. In most cases, advertisers have no real idea of who they're tracking anyway -- so it's difficult to see how one would "opt-out" of such data collection in the first place. It would seem that a much more efficient (and effective) solution is to just let the technology evolve to the point that users can block such tracking activities on their own. In many cases, that's already possible. On top of that, as companies like Phorm are discovering, the public outcry against even the possibility of doing something bad concerning clickstream tracking will hopefully keep these firms in check.

Filed Under: behavioral advertising, click tracking, clickstream, do not track, targeted advertising

Do Not Track List Won't Make Advertisers Happy

from the resistance-is-futile dept

Just as Facebook is looking to launch its own behavioral advertising network, AOL and some privacy groups are pitching the idea of a "Do Not Track" list that would effectively let people opt-out of behavioral advertising tracking. It's a challenging issue to deal with. Advertisers, obviously, want more data and information about who is viewing their ads, as well as having the ability to better target those ads. At the same time, the theory is that people are much more receptive to highly targeted, relevant ads. The problem, though, is that many internet surfers have no idea how much information they're handing over and how it's being used (and many would argue that the more relevant ads aren't actually appearing). If they knew how much data was being collected, however, many would probably be quite upset. The purpose of the Do Not Track list would be to give them back some control. Advertisers, of course, won't like this idea at all, as they often feel it's their divine right to have as much information as possible. They'll also complain that without this data, advertisements will actually be less relevant and less useful -- which might actually be true. In the end, though, it seems like while a "Do Not Track" may get lots of publicity, but how many people will actually sign up? Certainly I'd expect techies who are more concerned about this kind of thing to sign up -- but the average consumer? Unlike the "Do Not Call" list, most people don't even realize that they're being tracked, and so are much less likely to have the incentive to opt out of being tracked.

Filed Under: advertising, behavioral targeting, do not track
Companies: aol