Hacker News new | past | comments | ask | show | jobs | submit login
Watchdog ponders why Apple doesn't apply its strict app tracking rules to itself (theregister.com)
161 points by Logans_Run 63 days ago | hide | past | favorite | 68 comments



Love how Apple requires App Store free trials to last the full duration even if you cancel, but Apple's own free trials cancel instantly. Rules for thee but not for me...


I have not found this to be the case - just last week I signed up for a free 4 month trial of Apple Music and immediately (like, the next 30 seconds) canceled and retained my trial period. I have also done this with News and TV in the past.


Here is a 3 months old thread showing that Apple Music trial gets cancelled right away: https://www.reddit.com/r/assholedesign/comments/1g664x4/appl...


that's been happening for years even


Isn't that the free period Apple gives you for purchasing a new device? That's different than the actual free trial in app purchases normal apps get. I think they gave you four months of the service as a specific purchase. Third party apps could do that but then they'd have to manage all of those separate purchases.


That's great for you but I have TV+ and Arcade free trials and both end instantly if I cancel. And I'm not alone, lots of people across the internet experience this too. It's written in Apple's terms.


Replying to myself because I’m past the edit window - the trial I’m referring to was through a third party (Walmart) it sounds as if the terms vary on a case by case basis.


Same here, did it with apple music last week.


When I buy an iPhone and use iOS, I’m making an active choice to be an Apple user.

When I install a third-party app and use it, I’m making an active choice to be their user too.

When that third-party app embeds the Facebook SDK which tracks me, I don’t know about it and do not have the ability to consent to Facebook tracking me.

ATT brings Facebook to the same level as Apple and the third-party app developers by giving me the visibility and choice I would otherwise be deprived of. It should be possible to opt out of being a Facebook user. Being silently opted-in without consent is what ATT fixes.


If Apple believes the warnings are valuable...

Why not apply them to their own ecosystem?

Just because I might be a one-time user of an Apple product definitely doesn't mean I've made an active choice to be enrolled for marketing across their entire ecosystem, indefinitely.

Hell - I'm literally typing this on a Macbook that my work requires I use, I didn't make an active choice there at all...


>If Apple believes the warnings are valuable...

>Why not apply them to their own ecosystem?

OP is only claiming that warnings for third party tracking is valuable. I'm not sure you go from that to "we should have warnings for first party tracking (ie. GDPR-style cookie banners)".


You also don’t have a choice when Apple embeds tracking into their apps, third-party or not. I don’t see why Apple gets away with it just because it’s first party. Should I assume Reminders is sending tracking data to Apple and that’s okay?


For diagnostics and usage patterns only, of course.


Where's the consent? Where's the opt out? These are things we demand of all companies.


Every time I've ever updated my MacBook or my iPhone to the newest OS I got a popup asking if I wanted to consent to reporting anonymous usage data to Apple. I've always refused.

Am I to believe that Apple ignores my explicit refusal of consent and reports the data anyway?



If you trust Apple with what they do on your iPhone, you should trust the third-party with what they do inside their app, there is no difference.

If you need to know the details of what is done inside the third-party app, then that third-party is not trustworthy. Or you also need to know what is done inside iOS.

The problem is that in today world, we don't know who we can trust, and that the context might change over time. We all believe that Apple doesn't do shady stuff today, but has anyone proof? and will that change some day?


>If you trust Apple with what they do on your iPhone, you should trust the third-party with what they do inside their app, there is no difference.

Why is trust an all or nothing proposition? Why can't I trust an app to do whatever it wants within its sandbox, but not to get an unique identifier that can be shared between apps? It's not any different than sandboxing, where I trust the app to do whatever it wants in its sandbox, but not mess with my documents or OS.


> there is no difference.

That’s not true, Facebook’s business model is inherently privacy invading.


Do you compare Facebook that knows about your friends and holidays to Apple iPhone+iPad+mac+homepod+watch+health+card+wallet+mail+contacts+calendar+passwords+... ?


Apple makes money from selling me goods, Facebook makes money from selling my attention.

This is why I can trust Apple more than Facebook.


> When I buy an iPhone and use iOS, I’m making an active choice to be an Apple user.

> When I install a third-party app and use it, I’m making an active choice to be their user too.

Are you properly notified of exactly what they record, and where they record it? In a form an average user can easily understand and control? Can you opt out of changes in something you are locked into?


No, but that's not what this system is about. It's literally just "are you going to tell anyone else about what I'm doing?"


> When I buy an iPhone and use iOS, I’m making an active choice to be an Apple user.

I disagree. I’m choosing to be a user of the specific device that I bought, nothing more.


> When I buy an iPhone and use iOS, I’m making an active choice to be an Apple user.

At the time of the purchase, at best. If Apple changes their tracking after that and you don't agree with it, what will you do, sell the phone?


You're mixing things up.

There are two decisions:

1. To be a user.

2. To have data tracked.

Installing from the App Store is decision #1 but #2 is made separately.

Is buying a phone both #1 and #2 together? If so, why?


> When I buy an iPhone and use iOS, I’m making an active choice to be an Apple user.

No, I'm making an active choice to have a device capable of SMS, voice and video calls, and recordings.


> When that third-party app embeds the Facebook SDK which tracks me, I don’t know about it and do not have the ability to consent to Facebook tracking me.

With sensible data protection regulations, like GDPR, you must be informed and consent to it. We can talk about implementation details for months, but that's the gist of it.


The same reason they don't charge themselves 30% processing fees for subscriptions.

Money.


I think the tax haven co. charges parent co. 30% + naming rights charge + administrative charge + tax dodging holding fee + online booking fee.


They could charge themselves, but what would a couple of entries in bookkeeping do here. If you 'charge yourself' there is no cost, and no gain. It's meaningless.


It would make their apps look unprofitable on paper, unless they raised the prices 30% like every other developer has to.


I don't think they even report out on the profitability of individual apps. In fact, I don't think they report on software profitability at all: the categories they report out on are Mac, iPhone, iPad, Wearables, and Services.

No one outside of Apple has any real visibility into how "profitable" any individual app they make is, so I can't imagine this is a factor in why they don't charge themselves the 30% cut. In fact, I don't think there's even any way for us to know if they do—or if there would be any meaning to it if they did (ie, would the 30% even go to a different internal account?).


Right, but that's something any audit will poke right through, and if you take the paper trail (or follow the money) far enough, it just ends up with whatever tax haven corp that is used for the money either way, and the profits and losses still end up with a net zero difference.

Technically, it doesn't even matter where this split is made, if you go up the tree high enough, it merges and just cancels itself out.


What apps does Apple charge for?

TV I guess?


Maybe because opting into tracking via "Music" or "Photos" when I've already consented to tracking at the OS level is redundant? There's no unknown 3rd party here - it's all Apple. In the case of apps from the App Store, there are/were 3rd party trackers - I download "Candy Crush" and it sends data to Meta or Google or somebody else.


> I've already consented to tracking at the OS level

That's very wide and obscure. Even the bullet points for how the OS can track you go past what can be considered informed consent. If that consent covers every 1st party app that will ever run on the phone then it's a guarantee nothing in about it is really informed.

If you think a vague, blanket consent is all it takes then every company will get one in a jiffy. Just touch any company's real estate in any way whatsoever, get a prompt that "you consented to being tracked in any company related app forever", profit. You "consented".

Remember when Disney tried to get out of a wrongful death lawsuit by citing some agreement the family of the victim accepted for a Disney+ trial years before? [0] Well you're describing the same principle. Consent should be granular.

[0] https://www.nbcnews.com/news/us-news/disney-says-man-cant-su...


>Remember when Disney tried to get out of a wrongful death lawsuit by citing some agreement the family of the victim accepted for a Disney+ trial years before? [0] Well you're describing the same principle. Consent should be granular.

That case was wildly mischaracterized. The restaurant that allegedly caused the wrongly death was not owned or operated by Disney, but Disney was dragged into the lawsuit anyways on the basis that they listed the restaurant on their website. Disney retorted that if they could be on the hook for a wrongful death under such tenuous circumstances, that they should be let off the hook on the basis of the tenuous waiver the plaintiff signed years before.


> Disney retorted [...] tenuous waiver

They've since backtracked on that retort though and accepted the court process[0].

Although their first response was nothing to do with arbitration[1]. Their lawyers are flip-floppers.

[0] https://www.independent.co.uk/news/world/americas/crime/disn...

[1] "Disney made no mention of arbitration, instead arguing it was not liable because it has no control over Raglan’s operations or management and merely serves as its landlord."


> That's very wide and obscure.

It's not "obscure" to anyone who takes 5 minutes to ask for it. Apple will happily send you all the data they have about you.

https://www.cnet.com/news/privacy/apple-data-and-privacy-how...

https://www.zdnet.com/article/apple-data-collection-stored-r...


You're shooting blanks from the hip. Jumping to answer without even understanding the question or the point of the article.

When I activate a brand new iPhone I don't get presented with Cnet/Zdnet articles from 7 years that tell me that the OS tracking I'm consenting to now will be pooled with any tracking collected from any Apple app now or in the future.

Apple does not allow 3rd party apps to cross track. Insta app can't collect tracking from the FB app. And that's great. But Apple's apps are excluded from this and allow cross tracking. Apple pools together all the tracking it has access to between OS and apps. OP says they're fine with it because they already trusted the OS. But the OS and the apps are different things. What the OS does is at technical level, the apps know what medication I take, how well I slept last night, or which stores I buy my things in. Combining that is way more intimate than "OS tracking".

I trust Apple more than most other big tech companies but such policies still don't sit right with me. They advertise "privacy" but then eschew their own rules.

Downloading my takeout data after the fact won't prevent Apple apps from pooling tracking data in the first place.


Again, I'm responding to your "obscure" characterization. The information Apple collects is well-documented by Apple and others, and available for anyone to validate.

> Insta app can't collect tracking from the FB app.

Meta absolutely aggregates user data across their different applications/services.


> I've already consented to tracking at the OS level

Isn't that sentence by itself kind of insane? Tracking at the OS level used to be unacceptable.

Nobody should expect their OS to track them like this in the first place.


Not saying what's being collected isn't invasive but over time we've redefined spyware and tracking to include logging, error reporting, and telemetry.

Someone in the 90's would be imagining bonzi buddy when you say tracking when it's actually pendo.


This has it backwards: “telemetry” or otherwise collecting info without explicitly asking each time was definitely, for-sure just spyware as late as the mid ‘00s. We only later decided a bunch of that definitely-not-ok stuff was ok.


Companies have intentionally bucketed those things together with invasive ad tracking so they can obfuscate what the user is agreeing to.

As with GDPR, it's easy to offer a good user experience and do the right things by default, but there is an active choice being made to make it annoying and misleading to try and trick users into doing stuff that is against their own interests.


Apple isn't, I can turn off ad tracking and keep analytics on.


Sure, but the "redefinition" you talk of isn't consumers suddenly being unreasonable, it's the fact they've experienced so much gaslighting and unclear dark patterns they are (reasonably) assuming everything is suspect and rejecting it all.


And what about something like the AdvertisingID? The OS creates an identifier for the purpose of tracking you with ads.


Before that app developers were reading IMEI or mac addresses, which were arguably worse because they can't be reset.


Isn't that just because the sandboxing is really poor on mobile compared to the web? You cannot read those on the web.


> I download "Candy Crush" and it sends data to Meta or Google or somebody else.

Was the Candy Crush developer getting paid for inserting these trackers, or did they only get paid where they also showed ads?


Both companies offer various tracking products that don't require ads.

Google Analytics, Facebook share/login integrations, etc.


Mam, I wish I had your blind trust into multibillion corporations. I am experienced enough to know that I simply don't. Champions of privacy should do better, no they should clearly lead the market, like it was with updates.

I mean thats the main value proposition for Apple these days, no? At least for more tech users.


I don't trust Apple - I assume they're tracking. Their record here is better than Google or MS, but that's a pretty low bar. And now that I've picked my poison for overall ecosystem, I want to limit (or at least opt-in) to other tracking.


> strict ... rules do not cover Apple's own practice of combining user data across its ecosystem – from its App Store, Apple ID and connected devices – and using them for advertising purposes.

It is not obvious to me that Apple is doing this, at least in any meaningfully industrialized sense. The biggest third party advertising platform Apple runs is App Store ads, and I think it would be surprising indeed if Apple were using any data to influence these ads beyond "what have I downloaded from the App Store" (actually, they might not even use that, I seem to recall at some point they spoke on the extreme privacy of these ads. they might just be related search term ads).

The other major one is Apple News, which is such an underused, weird service that I can't bring myself to care about it.

There's a few other minor things that sometimes look like third party ads, like... the banners on Apple TV sometimes advertising an Apple TV+ show that might have been made by a non-Apple Studio? I've never gotten the sense that is personalized, at all, its always just some new show. Maybe there's some incentive payments on the backend of Apple Music that surface certain artists, like Spotify does? Grasping at straws.

First party advertising is a bit more prevalent, but I don't feel this is what the article is speaking on, because at the end of the day the ATT system is designed to stop the proliferation of personal data. For example, the ad in the Settings app to upsell customers on AppleCare+; the Fitness+ notifications some customers get; the Apple Store app recommending accessories for products it knows you own. I'm also not going to lose sleep over any of these things.

Weak argument. I don't see any evidence of Apple not holding themselves to an even higher standard than ATT and most other companies when it comes to security and privacy. The EU just hates American tech.


If you are opposed to the government regulating a market, then you haven't seen a company regulate one ...


Thankfully iOS is pretty complete without apps. I don't use apps, I don't find them more convenient than websites. I use my phone like a basic computer. I only really use more advanced things outside of news/calendar/maps on a home desktop PC.

I'm not particularly old-fashioned as I had a 12 year career in FAANG mostly working with sensitive PII and business data which is quite boring if you're not a criminal. But I understand that there is no real way to enforce the kind of privacy standards people seem to assume exist.


iOS devices come with apps pre-installed and this article is about how those apps do not conform to Apple's privacy policies.


Yes I read the article and the only new information for me was the opt-in dialog being used 4 times vs 2. I must not understand it because I've never seen it. The only one I can recall is the one they spam every time iOS updates, asking me to use Wallet several times until I navigate to the menu in settings.

What it doesn't mention is that ATTF is a voluntary program with no enforcement mechanism, currently.


Do you only use iMessage? No music player? No robot vacuum you need to control? Fitness tracker, car remote, Steam app for MFA, etc?


I don't use MFA, it is less secure than no MFA, so yes, no, no and no. I use VLC though but that doesn't use any tracking or data, afaik.

My roomba is 10 years old and has no wifi


Because it can make certain guarantees about how itself handles the user data, not so much beyond the walls.


> The Federal Cartel Office claims that Apple's ATTF defines "tracking" in a way that only covers data processing for advertising purposes across companies – but that these "strict ... rules do not cover Apple's own practice of combining user data across its ecosystem – from its App Store, Apple ID and connected devices – and using them for advertising purposes."

...yes. Apple defines "tracking" here as sharing your data with other companies, and then doesn't do that itself. Because that's the opaque and objectionable thing.

If you launch an Apple app then you probably expect Apple to know what you're doing. If you launch a Meta app, similarly you expect Meta to know what you're doing. But you might not expect Meta to immediately go and tell, say, some random company called Cambridge Analytica everything you're doing.

Meta absolutely could do exactly what Apple's doing without needing to warn users -- collect user data across its various apps, and use it to advertise its own products.

I do agree that Apple has carefully chosen a thing to object to that aligns well with their own business model. But I also think the thing they're objecting to is worth disclosing to users, so: ¯\_(ツ)_/¯


The article says that in 2022 Apple started disallowing first party tracking within providers, actually. So in fact Meta can't do that, while Apple still can.


Yeah, but then it describes what's clearly third-party tracking. It's The Register, you can't rely on them getting technical things right.

> As one programmatic ad news outlet pointed out, Facebook was actually hit the hardest by the 2022 first-party rules because its software development kit (SDK) "plugged into so many outside apps and ... its attribution pixels [were] littered liberally across the web."

The article they link to there about the 2022 rules is from 2021, incidentally, and is just talking about other apps embedding Facebook tracking -- i.e. third-party stuff. There's a lot of talking about how "first-party data is valuable to Facebook", but it's all referring to how Facebook wants to use the data from other people.


While there is always room for improvement, i think the lack of of proper (crash & debug) analytics being sent home are the only remaining explanation explanation for the abysmal software quality at Apple.

How else could they repeatedly fuck up the basics? Every second release has awful battery life because half the daemon processes are running wild in 100% CPU parties. The only reasonable explanation for this nonsense is that Apple doesn't know about all the problems (or cannot fix them) because they refrain from collecting the required data...


That's an open secret, good to see regulators finally seeing this double standard.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: