In June, an Apple security engineer wrote a blog post that sent the bustling, $83 billion digital ad industry reeling.
In it, he described a new feature, recently rolled out in the latest version of Apple’s Safari web browser, to limit so-called cross-site tracking, where advertising networks and other services can monitor behavior from site to site. The feature, called Intelligent Tracking Prevention (ITP), uses machine learning to spot trackers in the act and limit their reach.
The feature quickly won praise from privacy advocates–the Electronic Frontier Foundation called Apple’s move “an important step to protect your privacy.” The online advertising sector has not been as supportive.
In a letter published last month, a group of industry groups slammed the software rollout as harmful to ad-supported sites and consumers alike. They argue that Apple’s move substitutes the company’s standards for industrywide conventions around cookies, the digital files used to record user behavior and settings online, and will lead to consumers seeing less relevant and useful ads. Safari, the letter said, “breaks those standards and replaces them with an amorphous set of shifting rules that will hurt the user experience and sabotage the economic model for the internet.”
“Advertising is the engine that powers the internet experience, and consumers need to be in the driver’s seat,” wrote Dave Grimaldi, executive vice president of public policy at the Interactive Advertising Bureau, in an emailed statement to Fast Company. “Apple’s unilateral actions run contrary to that fundamental principle, and could prevent the types of digital ads that support publishers all across the web.”
Naturally, advertisers and the companies are are already thinking about strategies to work around Safari’s restrictions. In the short-term, that might mean working with publishers to store some advertiser data and user identifying information in site-specific, or first-party, cookies, according to a blog post from Dennis Buchheim, general manager of the Interactive Advertising Bureau’s Tech Lab. Longer term, it might mean somehow routing users of multiple sites through a single domain, either through page redirects or something like a single-sign-on portal, to read and plant a shared cookie, he writes.
Of course, it’s possible that privacy protection software, whether in browser plugins or browser themselves, could start to filter out such domains, potentially setting up the next stage of the cat-and-mouse game. (Apple didn’t respond to an inquiry from Fast Company.)
In response to the ad industry letter last month, Apple wrote in a statement to reporters that it “believes that people have a right to privacy,” and said the new Safari was intended to protect that. “Ad tracking technology has become so pervasive that it is possible for ad tracking companies to recreate the majority of a person’s web browsing history,” the statement said. “This information is collected without permission and is used for ad re-targeting, which is how ads follow people around the Internet. ”
Watching Where You Click
It’s a familiar experience to any regular internet user: Visit a website selling footwear or sharing updates on your favorite band and see offers for shoes or concert tickets on nearly every other site you visit. Tracking your browsing habits from site to site is lucrative for online advertising networks and the publishers who rely on ad revenue to keep their sites afloat. After all, advertisers generally pay more for ads that get more people to click on them, and ads targeted toward proven interests of individual consumers are naturally more effective at driving traffic. Facebook, Google, and Bing all customize ads based on behavior on other sites, and so do plenty of other ad networks that aren’t quite household names.
“That third-party data sharing is sort of the foundation of how modern digital advertising works, for the most part,” says Peter Reinhardt, CEO of Segment, which enables companies to aggregate data about visits to their own sites, though not their behavior elsewhere on the web.
But to consumers, excessive tracking can come off as creepy and intrusive, and it can unintentionally reveal browsing habits to other users of a shared computer, even if they’re not trying to snoop. In recent years, for instance, warnings about targeted ads exposing gift searches have been a mainstay of holiday shopping advice. Experts have also, perhaps more seriously, warned similar practices can be used to target custom-tailored political propaganda or deliver higher-cost offers to consumers seen as more willing to spend. And tracking can come to be seen by consumers as a betrayal of trust, Apple security engineer John Wilander wrote in his June blog post.
“The success of the web as a platform relies on user trust,” he wrote. “Many users feel that trust is broken when they are being tracked and privacy-sensitive data about their web activity is acquired for purposes that they never agreed to.”
Other browsers like Mozilla Firefox, Microsoft Edge, and Google Chrome do let users choose to block third-party cookies, but relatively few users take advantage of such features, though it’s likely many aren’t aware of the option often buried within settings menus, or how it would affect their browsing sessions.
“Right now, very few people disable third-party cookies,” says Reinhardt. “It’s basically Safari users and people who are conscious about online privacy, which is a fairly small percentage.”
While Apple—which is much less reliant on ad revenue than rival mobile operating system and browser maker Google—is at the forefront of developing the automated restrictions, it’s not the only organization looking to shape user privacy and ad behavior online. The European Union’s forthcoming General Data Protection Regulation (GDPR) will require sites to explicitly gather European users’ consent for how their data is used, and more and more users are turning to ad blockers and other pro-privacy browser plug-ins.
Google, meanwhile, has announced plans to filter out obnoxious ads that flash colors or play unwanted sounds in upcoming versions of Chrome–which, as its ad-blocking adversaries readily point out, is part of Google’s battle to keep people looking at ads, period.
“We believe we’re at the tip of the iceberg of this,” says Chris Olson, CEO of The Media Trust, which monitors online ads for shady behavior. “The data privacy and data compliance [requirements] with the advent of GDPR regulation coming out of Europe is really becoming a bigger issue.”
It’s possible that browsers could come to support user-specific advertising IDs, a technique already used with mobile devices to track users and serve ads to them with more explicit oversight by users and operating system makers, writes Buchheim.
“This would provide better control in the hands of users to manage their privacy while supporting the advertising ecosystem and solution providers, including support for opt-in and opt-out by users for specific service providers,” he writes.
More Akin To Junk Mail
One possibility for ad-reliant publishers is that the tracking restrictions will ultimately improve the quality and respectability of digital ads, leading to more of the sort of lucrative big-brand advertising familiar from television and print media, says Jason Kint, CEO of Digital Content Next, an online publishing trade organization.
“At the end of the day, it will increase the trust in digital advertising, which is significantly lower than other forms of advertising,” he says.
Advertisers could still target ads to particular segments of the population based on factors like the context where their messages will run, just as they currently do in traditional media like TV, radio, or print. Right now, the majority of ads online are automatically targeted and “more akin to junk mail in your mailbox,” he says.
“That’s not what pays for high-quality news and entertainment,” he says. “That’s not what builds consumer trust.”
But in the short term, advertisers may flock even more to the existing giants of targeted ads: Google and Facebook, which together reportedly bring in about half of all global online ad revenue. The two companies not only draw big volumes of traffic but also have a huge advantage in that consumers naturally provide them directly with personal data, from search queries to clicks, from likes to reactions to photos.
That advantage makes Silicon Valley’s data giants less reliant on third-party tracking, and thus less impacted by Apple’s new tracking restrictions. It also, arguably, gives those companies more power.
“There would be an even bigger lean toward the companies that have walled gardens and can control first-party data, so for an amount of time, power shifts in their direction,” says Olson.
Apple’s new rules also give special privileges to third-party sites that consumers visit directly, letting them store data for up to a day. That means that sites like Google and Facebook that many users visit on a regular basis are likely to be less affected in their ability to store data from other sites than ad networks that other users seldom directly visit.
Olson and other observers remain optimistic that publishers and advertisers will ultimately find a more sustainable way to market to the right web users, still an elusive goal even after roughly two decades of mainstream web advertising.
“Anyone who’s really pushing too hard back on Apple right now, I question whether they’re looking to the future,” says Kint. “They’re trying to save a model which is clearly not working.”