Hello, friends,
Apple and Google have each recently announced privacy initiatives that affect millions of people and have stirred up controversy. Facebook has launched an ad campaign claiming that Apple’s changes will hurt small businesses. And critics have called Google’s initiative “privacy theater.” But unless you are a tech expert, it can be difficult to understand what exactly is changing—and how it might impact you.
The Markup reporter Alfred Ng broke down Apple’s changes this week in one of our Ask The Markup features. And I cobbled together an understanding of Google’s changes from my own reporting. And so, here, without further ado, is what you need to know about the privacy changes at two of the biggest tech companies on the planet.
What is Apple doing? Apple has said that its new iPhone operating system will soon prevent apps from sharing data about users without their consent.
Apple is doing this in two ways: First, it is providing what it calls “privacy nutrition labels” in the app store that require apps to disclose what data they collect and share; and second, it is moving to an opt-in regime, so that apps must get consent for permission to share identifying information with third parties for advertising purposes.
Privacy nuts like me regularly go into our iPhone settings and reset the so-called “advertising identifier” and turn off personalized advertising. When Apple’s change rolls out, that type of vigilance will no longer be necessary. The advertising identifier will be set to all zeros by default unless you agree to data-sharing.
Why is Facebook so mad at Apple? Facebook claims that Apple’s privacy changes will hurt small businesses who rely on personalized advertising to reach customers. But some Facebook insiders have told the press that the changes won’t make a big difference for many small business owners. Facebook states that Apple’s policy “requires apps to show a discouraging prompt that will prohibit collecting and sharing information that’s essential for personalized advertising.”
Perhaps more relevant is that Facebook has said that Apple’s privacy changes could hurt Facebook’s own ad revenues.
When do Apple’s changes go into effect? Apple has not said exactly when it will roll out the change. In January, the company said the changes would be “starting soon.” Ad tech companies that make a living tracking users—many of which are “preparing for the worst”—have speculated that it will roll out this month.
What is Google doing? Last year, Google said that its popular web browsing software, Chrome, will phase out support for third-party cookies that track users across the web by 2022. This year, Google reaffirmed its pledge and added that “we will not build alternate identifiers to track individuals as they browse across the web, nor will we use them in our products.”
Why is this a big deal? Google Chrome is the last major web browser to commit to blocking third-party cookies by default (and it’s worth noting that it still hasn’t implemented this change).
Apple’s Safari web browser was the first mainstream web browser to block third-party cookies by default. (The privacy protecting Tor Browser has had the feature since inception.) Mozilla’s Firefox browser and Microsoft’s Edge browser both began offering tracking protection by default in 2019.
Since third-party cookies are an essential building block of the online ad tracking ecosystem, Google’s decision could be a crippling blow. Shares of ad tech companies such as The Trade Desk and Pubmatic have fallen since Google’s announcement. And ad tech industry blogs are filled with stories about how to “prepare for the ID-Pocalypse” and why marketers should now be focused on “data frugality” and the search for cookie-less “emerging identifiers.”
The Interactive Advertising Bureau, a trade group for ad tech, has said that the loss of third-party cookies could lead to a $10 billion loss of revenue for the industry.
Will Google still track users across the web? Why, yes. It seems that Google has no intention of giving up its surveillance model entirely. Google says it is experimenting with several tracking methods that it claims will be privacy protecting.
One of its top proposals is something called FLoC—or Federated Learning of Cohorts. Essentially FLoC would allow the Chrome web browser to create groups of thousands of users with similar web browsing habits and allow advertisers to target those cohorts.
Google says that forming large clusters of users would allow personalized ad targeting without revealing “information that is too personal.” But assigning users an identifier based on their web browsing activity sounds remarkably similar to cookies. As the EFF wrote in its blog post objecting to FLoC, “Your FLoC ID will be like a succinct summary of your recent activity on the Web.”
How can I turn off Google’s newfangled web tracking? It’s not exactly clear yet. Google spokesperson Victoria Keough told me that Chrome “will give you the option to opt out of being placed in cohorts as we start testing FLoC with advertisers. We are working to offer even more controls and transparency in the future as we incorporate feedback.”
Of course, forcing users to opt out of FLoC is less privacy protecting than having tracking blocked by default, as offered by other web browsers.
Does Google’s proposal enable fingerprinting? Web fingerprinting is a tracking technique that uses unique characteristics of your web browser to identify you—rather than using cookies.
Adding FLoC IDs to users’ web browsers would make it a lot easier for web fingerprinters to identify users, according to Princeton computer science professor Jonathan Mayer.
In a white paper on FLoC privacy, Google states that a cohort ID “cannot, by definition, be used as a fingerprint.” The words “by definition” are footnoted with the words “if used in totality (ie not paired with other signals).”
However, as Mayer points out, “the whole point of fingerprinting is to combine signals.” So Google’s defense against fingerprinting amounts to, he said, “if you don’t fingerprint, then it can’t be used for fingerprinting.”
Google spokesperson Keough said, “We are indeed still looking at its fingerprinting risk, and we expect to make changes addressing that risk.”
What are the antitrust implications of Google’s and Apple’s moves? It can’t be overlooked that both companies are facing increased regulatory scrutiny.
Google is being sued by the Federal Trade Commission and two separate coalitions of state attorneys general for abusing its monopoly power. And Apple’s app store practices are being investigated by EU regulators.
One of the coalitions of state attorneys general has already amended its complaint to allege that Google’s privacy changes are illegal: “Google’s new scheme is anticompetitive because it forecloses competition in the exchange and ad buying tools market while simultaneously providing Google with a workaround.”
“Attorney General Paxton’s latest claims continue to mischaracterize many aspects of our business,” Google spokesperson Keough said, “including the steps we are taking with the Privacy Sandbox initiative to protect people’s privacy as they browse the web.… We will strongly defend ourselves from AG Paxton’s baseless claims in court.”
As always, thanks for reading.
Best,
Julia Angwin
Editor-in-Chief
The Markup