Power Play: Big Tech’s Feud Over Mobile App Tracking

Apple and Facebook's dispute over iPhone data tracking reveals more about corporate power over the internet than it does about user privacy.

People looking at their mobile phones are surrounded by app icons that feature open eyes, most of which have been crossed out.
Carmen Deñó

The debate around internet privacy is intensifying, and leading tech companies are coming into direct conflict over consumer tracking. Apple and Facebook are articulating visions for the future of mobile advertising and consumer data that seem irreconcilable, but they both ultimately reflect the concentrated power that enables a few giant corporations to make key privacy decisions for billions of internet users.

Apple’s recent release of an update of its iOS mobile operating system has sent shockwaves throughout the digital advertising sector. The big change is that apps must now get explicit permission from iPhone users before tracking their data across apps or websites owned by other companies.

No company has been more vocal in its opposition to this than Facebook. Arguing that it will undercut the revenues of content creators and app developers, the company insisted last fall that the shift against tracking “could have a meaningful negative effect on small businesses and economic recovery in 2021 and beyond.” Facebook and Instagram later implemented notices within iOS saying that their tracking of device data and “information about your activity received from other apps and websites” helps keep them “free of charge.”

The technical aspect of this dispute concerns the IDFA, a unique identifier installed on every iPhone that enables companies to recognize individual devices. Much in the same way that HTTP cookies facilitate tracking across the web, the IDFA is a kind of skeleton key that lets businesses partner with ad platforms and data brokers to build consumer profiles as well as buy and sell targeted advertising.

For years, apps have been able to freely access IDFAs by default. With the App Tracking Transparency (ATT) feature, Apple has now locked the IDFA behind a permission notification that asks users to choose whether the app can track or not. If they grant permission, it’s business as usual: the apps are free to collect and exchange IDFAs to track users across the digital media landscape. But when users opt-out, Apple restricts access to the IDFA, depriving apps of a crucial data point for targeted advertising.

Apple argues that this change is motivated by their concern for consumer privacy. “At its foundation, ATT is about returning control to users — about giving them a say over how their data is handled,” said Apple CEO Tim Cook earlier this year. Later, speaking with Kara Swisher of The New York Times, Cook was incredulous that providing consumers with control over their data in this way could be considered controversial. “I think privacy is one of the top issues of the 21st century,” he said. “And I think we’re in a crisis.”

Many in the digital advertising sector disagree. In a combative public relations campaign that included a series of full-page ads in national newspapers, Facebook claimed that it was standing up to Apple, whose unilateral privacy efforts would “change the internet as we know it — for the worse.” Without the ability to track potential customers, Facebook warns, millions of small businesses will suffer.

No one in Big Tech cared about privacy until it looked like it could become a competitive weapon, available only to those with the monopoly power to wield it.

Let’s be clear about the exact cause of this controversy. Apple is not eradicating the IDFA. It is not nuking the mobile advertising industry from space. It is not even introducing a new capability to restrict tracking. This option has been available on iPhones since 2012, albeit buried in the no man’s land of user preferences.

So what has Apple done, precisely? By mandating a clear and conspicuous tracking toggle, Apple has simply compelled surveillance advertisers to actually do what they have claimed to do for years: give users control over their personal data.

Opting out vs. opting in 

Surveillance advertisers have long touted their commitment to the fair information principles of  “notice and choice” in their privacy policies, corporate mottos, and public statements. As Facebook states on its privacy site: “We recognize that… not everyone wants to share everything with everyone — including with us. It’s important that you have choices when it comes to how your data is used.”

But in practice, Facebook and many others have implemented these values through byzantine and ineffectual opt-out mechanisms. This form of data self-management has been a disaster for privacy, but has helped to normalize consumer tracking while shielding the industry from criticism and regulatory scrutiny. After all, how can surveillance be exploitative or invasive if consumers knowingly agree to it in exchange for free services and relevant advertising? This faulty logic has held up remarkably well in the US, which still maintains that industry self-regulation is the best way to govern internet privacy.

Now faced with the prospect of a meaningful exercise of consumer control, ad platforms and marketers are appalled. Apple has shifted the implementation from the business-friendly opt-out standard to the more consumer-friendly opt-in approach, but the principles of “notice and choice” that ostensibly underpin both mechanisms should be exactly the same. So why are big surveillance advertisers like Facebook so upset?

Apple’s changes have very little impact on first-party data, the information that companies collect from direct interactions with consumers. Rather, the update concerns how identifying data is shared among the third-party ad platforms and data brokers that power surveillance advertising behind the scenes. While the business landscape of these activities is vast, the market for third-party data revolves around major players like Facebook, which made nearly 98 percent of its $84 billion in revenue from targeted advertising in 2020. It seems the company’s old “move fast and break things” motto only applies to things that don’t make boatloads of cash for Facebook.

While Facebook’s pushback against Apple is meant in part to bolster its public image by aligning with small businesses, what it really shows is the utter shallowness of the company’s own commitment to the privacy values it claims to uphold. And it highlights, once again, the astounding cynicism of the surveillance advertising industry’s approach to privacy. Preaching the gospel of consumer empowerment is one thing. Giving consumers even a modicum of meaningful control is too much to bear.

The writing on the wall

Hypocrisy and self-serving motives aside, preliminary evidence suggests that Facebook has reason to be worried about Apple’s privacy play. Though Apple hasn’t yet released data about how consumers are responding to the new tracking prompts, the Verizon-owned mobile analytics firm Flurry reports a daily opt-in rate of around 6 percent for US iPhone users. In other words, when given a clear choice to allow or reject third-party tracking, the vast majority — 94 percent — decide against it.

Depending on where you stand in relation to the digital ad industry, this news is either a pearl-clutching shocker or an absolute no-brainer. Overwhelming opt-out rates confirm what privacy advocates and researchers have been saying for years: people want more privacy and greater control over their data. If this pattern holds, Apple will have struck a powerful blow against one of the surveillance advertising industry’s favorite talking points: the so-called privacy paradox.

First articulated by academics in 2007, the privacy paradox refers to the hypothesized incongruity between consumer attitudes about data disclosure and actual consumer behaviors in the marketplace. Researchers investigated why people who claimed to care about privacy nevertheless seemed to act in ways that undermined their privacy values. Why, for example, do people who value privacy still use invasive services like social media?

As academics tested and debated these questions, marketers and ad tech spokespeople latched onto the idea that consumers care more about free services than they do about privacy. The growth of Facebook and other big platforms, it seemed, was testament to this. For the ad sector, the privacy paradox rationalizes surveillance: people say they care about privacy, but their actions prove otherwise.

With ATT, Apple has unleashed a vast experiment to test the privacy paradox hypothesis in conditions that, for the first time, do not favor the surveillance advertising status quo. So far, the near universal opt-out rates for mobile tracking not only show that consumers value privacy, but also demonstrate that people will act on their privacy values when companies make it simple and intuitive to do so. That so many people have previously submitted to surveillance is less a behavioral paradox than a function of the advertising industry’s backhanded approach to consumer empowerment.

Apple’s calculations

Facebook’s campaign to discredit Apple belongs on the already mountainous heap of evidence showing that surveillance advertising’s leading purveyors cannot be trusted. But does this mean we should trust Apple?

Leading privacy advocates consider Apple’s implementation of ATT a step in the right direction. There is no question that Apple has a much stronger track record than Facebook on privacy issues and that, in the immediate term, Apple has delivered something useful for the millions of consumers who object to unfettered commercial surveillance. Facebook’s despicable track record on so many issues often overshadows Apple’s own misdeeds, not the least of which is its appalling pattern of labor exploitation.   

The reason it is preferable that Apple is calling the shots on mobile privacy and not Facebook is simply that Apple’s business model has historically been less dependent on surveillance. In 2020, about 80 percent of Apple’s revenues came from selling smartphones, tablets, computers, and other devices. Facebook, of course, is a surveillance company through and through.

Apple’s hardware-driven business model insulates it from some of the market pressure felt by Facebook and others to monetize tracking. But, as Ian Bogost and others have pointed out, Apple is deeply integrated into the surveillance advertising business even if its participation has generally been indirect. For example, Google, the only surveillance advertiser bigger than Facebook, pays billions of dollars a year to be the default search engine on Apple software, which helps “funnel out enormous volumes of data on Apple’s users, from which Google extracts huge profits.” Even if it doesn’t make money from invading consumer privacy directly, Apple does extremely well “selling the glass rectangles on which the more invasive apps run.”

Until now, advertising has been a small part of Apple’s main business, but it would be foolish to think this cannot change. Even a $2 trillion technology empire must still confront the structural imperatives of capitalism, where shareholders demand growth above all else. Apple has struggled in recent years to reliably expand hardware sales, but has found strong growth opportunities in services like streaming and — you guessed it — advertising.

The dust-up over IDFA is about more than privacy or sticking it to Facebook. It’s about wielding and maintaining concentrated power over the mobile internet.

Over the past several years, Apple has ramped up its advertising business with a retooled mobile ad network and attribution solution, as well as a new ad product in the App Store that is forecasted to bring in $2 billion in fiscal year 2021. Apple clearly recognizes advertising as a business worth investing in. Its current approach embraces consumer privacy, but it’s a particular standard of privacy that Apple defines and controls alone.

Facebook once marketed itself as a privacy friendly alternative to the leading social networks of the day. It was a “privacy-friendly business” until it wasn’t. As Jacob Silverman notes, “neither Facebook nor Apple should be trusted as a benevolent sovereign to guide the direction of the internet or digital communications.”

Platform power

If Apple’s advertising plays are better for privacy than the status quo, they are also unmistakable attempts to consolidate power by creating systems and rules over which Apple has ultimate authority. In this sense, the dust-up over IDFA is about more than privacy or sticking it to Facebook. It’s about wielding and maintaining concentrated power over the mobile internet.

As amusing as the spectacle of Tim Cook and Mark Zuckerberg squaring off may be, the bigger picture is that the internet, once heralded as a fundamentally democratic technology, has become more or less a collection of fiefdoms ruled by quasi-monopolists.

The surveillance advertising economy developed part and parcel with a buildup of concentrated power in the ad-tech sector, notably the Google/Facebook duopoly. Now Apple threatens to alter the balance of that economy through its own outsized market power in mobile operating systems (a power only matched by Google’s Android OS). Without its vice grip over app distribution, Apple would be unable to implement such sweeping privacy changes in the first place.

Google’s recent decision to depreciate the HTTP cookie highlights this dynamic. The same company that leveraged third-party tracking to become the leading surveillance advertising platform has now unilaterally decided to retire it in favor of a more privacy-friendly system. While limiting third-party tracking cookies is a net gain for consumers, critics note that Google will continue to use its vast first-party data to track and target users across its popular services, a strategy not available to most of Google’s ad tech competitors. Data brokers like Acxiom have accused Google of “weaponizing privacy to justify business decisions that consolidate power to their business and disadvantage the broader marketplace.”

In the same way that Apple’s anti-tracking push is enabled by its dominance in mobile, Google is leveraging its Chrome web browser’s 60 percent global market share to shape the structure of digital advertising in ways that favor its business goals. Both of these changes improve privacy, which is good, but let’s not confuse the means for the ends.

The history of the internet’s commercialization shows that business is generally indifferent to privacy at best. For 25 years, markets have incentivized companies to turn the internet into a surveillance hellscape. This has been extremely lucrative for Google, Facebook, and, yes, Apple, and has helped these companies amass inordinate market power. No one in Big Tech cared about privacy until it looked like it could become a competitive weapon, available only to those with the monopoly power to wield it.

The undemocratic nature of the internet becomes most pronounced when dominant tech titans squabble with each other, but there are key areas where these rivals find easy consensus. The first and foremost is that whatever happens, the private sector should call the shots, not democratic institutions. The whims and spats of unaccountable tech companies affect huge swaths of economic activity and dictate in very concrete terms what people can and cannot do online. In such a system, privacy lies outside the purview of democracy, as do most of the important decisions about the structure and values of our communications infrastructures. As John Naughton put it: “If Apple is the only organization capable of defending our privacy, it really is time to worry.”

It has taken the private sector decades to make a small step in the right direction for internet privacy. If we continue to leave it to Tim Cook and Mark Zuckerberg to foster an era of meaningful internet privacy, we will be waiting a very long time.

Follow The Reboot

Join a growing community that’s examining the state of the internet and exploring its future. Subscribe to our newsletter.

People looking at their mobile phones are surrounded by app icons that feature open eyes, most of which have been crossed out.

Artwork By

Carmen Deñó

Contact Us

Have an idea for a story or illustration? Interested in discussing partnerships? We want to hear from you. Send us a note at info(at)thereboot(dot)com.

Recommended Reading