Apple's anti-tracking tech is mostly working, but it can't block everything

A new study from the University of Oxford reports that App Tracking Transparency is largely living up to Apple's privacy promises — but motivated advertisers are finding solutions that Apple can not stop.

App Tracking Transparency (ATT), introduced with iOS 14, replaced the old Identifier for Advertisers (IDFA) and was intended to stop advertisers being able to track a user's internet or app use without their permission. It's already been partially responsible for Facebook's reduced revenue growth.

"Goodbye Tracking? Impact of iOS App Tracking Transparency and Privacy Labels," is a new research paper from computer science specialists at the University of Oxford, UK. The authors confirm that ATT is working, but note that Apple itself is tracking users, argues that the privacy measures have prompted workarounds, and also criticizes Apple's "nutrition labels."

"We find that Apple's new policies, as promised, prevent the collection of the Identifier for Advertisers (IDFA), an identifier for cross-app tracking," says the full report. "Smaller data brokers that engage in invasive data practices will now face higher challenges in tracking users - a positive development for privacy."

However, the authors "find real-world evidence of apps computing and agreeing on a fingerprinting-derived identifier through the use of server-side code." This use of tracking is based on where users go online, it works at their destination instead of on the iPhone itself.

This is in violation of Apple's rules, yet it continues, "highlighting [the] limits of Apple's enforcement power as a privately-owned data protection regulator."

Then "Apple itself engages in some forms of user tracking," and "the new Privacy Nutrition Labels are sometimes inaccurate and misleading, especially in less popular apps."

"Overall, our observations suggest that, while Apple's changes make tracking individual users more difficult, they motivate a countermovement," say the authors, "and reinforce existing market power of gatekeeper companies with access to large troves of first-party data."

"We conclude that the new changes by Apple have traded more privacy for more concentration of data collection with fewer tech companies," it continues. "Stricter privacy rules may encourage even less transparency around app tracking, by shifting tracking code onto the servers of dominant tracking companies."

"Despite the new rules, large companies, like Google/Alphabet and Facebook/Meta, are still able to track users across apps, because these companies have access to unique amounts of first-party data about users," say the authors. "Apple is now able to track its customers even more accurately, by taking a larger share in advertising technologies and getting unique access to user identifiers, including the device serial number."

Apple has not commented on the report, but it has previously addressed the accusation that it is using ATT to effectively block rivals in favor of its own advertising.