Apple continues to phase out its all-too-trackable UDID, introducing in iOS 6 a user-visible control to opt out of advertiser tracking. But privacy is far from assured.
From the first developer-enabled release of iOS, Apple provided API access to an ID string -- the UDID -- that uniquely identifies a particular device. Not only advertisers but run-of-the-mill apps were soon abusing it with abandon, ignoring Apple's guideline that stipulated the UDID was not to be combined with any other data so as to identify a user. (Some of this abuse came to wider notice when the anonymous hacker collective AntiSec leaked a million UDIDs.) To deflect the criticism directed its way by privacy advocates, Apple deprecated the API call that returns a UDID, and said that the capability would be removed entirely in a later release.
Apple continues to move forward on this agenda. New in iOS 6, released this week, is the "Advertising Identifier," which Apple explains this way:
iOS 6 introduces the Advertising Identifier, a non-permanent, non-personal, device identifier, that advertising networks will use to give you more control over advertisers' ability to use tracking methods. If you choose to limit ad tracking, advertising networks using the Advertising Identifier may no longer gather information to serve you targeted ads. In the future all advertising networks will be required to use the Advertising Identifier. However, until advertising networks transition to using the Advertising Identifier you may still receive targeted ads from other networks.
Apple provides a "Limit Ad Tracking" control by which users can assert that they do not want to be tracked. (The above text appears behind a "Learn More" link on the Limit Ad Tracking screen.) The control is buried rather deeply in the iOS Settings; here's how to find it.
Comparison to Do Not Track (DNT)
DNT is a 2-year-old privacy initiative that is now under discussion by the World Wide Web Consortium (W3C) in a process that may lead to standardization. The concept is that a user's browser sends a DNT flag, which advertisers and others are expected to honor by refraining from tracking the user. Being browser-based, DNT has more relevance for desktops and laptops than for mobile devices, where much of the advertising doesn't come through the browser, but rather through apps.
Many parties, from privacy-advocating technologists to the Interactive Advertising Bureau, are meeting regularly under the auspices of the W3C to thrash out the definition of the DNT flag and the behaviors required of and forbidden to advertisers that receive it. From the current condition of the Editor's Draft (part 1; part 2), it seems clear that the various sides in this negotiation are far from consensus.
In contrast, Apple is able to implement its Advertising Identifier unilaterally. iOS users will enjoy whatever protection the Advertising Identifier affords long before Do Not Track is standardized and widely implemented.
So they're going to stop tracking us, right?
When most iOS devices are running iOS 6, and some fraction of users have selected the Limit Ad Tracking option, and most companies in the advertising ecosystem have implemented support for it -- does that mean that iOS users will no longer be tracked if they don't want to be? Simply put, the answer is no.
Consider this press release from Fisku, a Boston-based company in the business of helping brands optimize their iOS and Android mobile app marketing campaigns. Part of what Fisku does is to provide mechanisms for tracking and attributing downloads of clients' apps. To do this they need a way of uniquely identifying the device onto which an app was downloaded. Apple's UDID suited that purpose admirably.
Fisku's press release notes that during the industry's transition away from UDID and to the Advertising Identifier, the company's SDK "will also continue to support other attribution technologies -- HTML5 Cookie Tracking, Digital Fingerprinting, and MAC Address." So advertising companies that use Fisku's SDK, or those of any of its many competitors, will have easy access to multiple methods of tracking devices (and users) beyond the restricted Advertising Identifier.
All credit and kudos to Apple for moving aggressively to give users some control over advertiser tracking. But iOS 6 and the Advertising Identifier will not put an end to the pervasive tracking of user behavior.