https://arstechnica.com/gadgets/2023/07/apple-tries-to-close-privacy-loopholes-with-new-app-submission-policy/ Skip to main content * Biz & IT * Tech * Science * Policy * Cars * Gaming & Culture * Store * Forums Subscribe [ ] Close Navigate * Store * Subscribe * Videos * Features * Reviews * RSS Feeds * Mobile Site * About Ars * Staff Directory * Contact Us * Advertise with Ars * Reprints Filter by topic * Biz & IT * Tech * Science * Policy * Cars * Gaming & Culture * Store * Forums Settings Front page layout Grid List Site theme light dark Sign in App Store -- Apple will require app devs to explain exactly why they use certain APIs Some seemingly innocuous APIs are misused to track users, Apple says. Samuel Axon - Jul 28, 2023 9:58 pm UTC A blue smartphone with two cameras. Enlarge / The back of the iPhone 13. Samuel Axon reader comments 15 with Apple has announced an additional hoop developers must jump through to get their apps approved on its App Store. Soon, developers of apps that use certain APIs will have to clarify their reasons for using them when submitting those apps. Apple is trying to close some fingerprinting loopholes here. The term "fingerprinting" in this context refers to various techniques for learning information about a device or its user and tracking them across multiple unrelated apps or websites. It's something that Apple has been saying is not allowed in iPhone apps for a while, and the company introduced the controversial App Tracking Transparency initiative in 2021 to give users a choice in whether things like mobile ad networks (for example) could track them in this way. That said, some more creative and stealthy forms for fingerprinting have been prohibited since then, even if users do opt in to be tracked--and those include misuse of the APIs in question here. Further Reading Your iOS app may still be covertly tracking you, despite what Apple says Clever developers can find ways to use the features, information, or tools they offer to track users in exactly the sorts of ways Apple has been trying to stop--even if that wasn't the main purpose of the API. The APIs that developers will have to justify do things like see file timestamps or look at system boot times, among others. In Apple's words, these apps can be "misused to access device signals to try to identify the device or user, also known as device fingerprinting." Of course, developers can still technically lie and say they're using an API for one thing when they're actually using it for something else. Apple addresses that with the somewhat vague policy that "declared reasons must be consistent with your app's functionality as presented to users." Advertisement It won't be a perfect system, but it's likely it will allow Apple to at least decrease the practice of fingerprinting. Apple previously stated that this change was coming during WWDC 2023, but the company revealed more details and a specific timeline this week. Further Reading How Apple's new App Tracking Transparency policy works The rollout will be slow, giving developers plenty of time to respond--at least those who are in a position to actively maintain their apps. Starting this fall, developers who upload an app or an app update that uses one of these APIs will receive a notice that they will need to specify a reason soon. In spring of 2024, apps that haven't done this will be rejected. It will be as easy as picking a pre-approved list from a dropdown menu upon app submission for some developers. Still, others may have to do more substantial work--in particular, those who have been taking advantage of this loophole will need to do some development work to change their applications to make them stop doing that if they can't make a case that one of the approved reasons applies. Those who feel the pre-approved reasons fail to include their own legitimate, non-fingerprinting reason for using an API can contact Apple via a form to request a new reason be approved. reader comments 15 with Samuel Axon Samuel is a senior editor at Ars Technica. He primarily covers software development, gaming, Apple, consumer technology, and mixed reality. He has been writing about gaming and technology for 15 years, and is a Chicago-based game developer. Advertisement Channel Ars Technica - Previous story Next story - Related Stories Today on Ars * Store * Subscribe * About Us * RSS Feeds * View Mobile Site * Contact Us * Staff * Advertise with us * Reprints Newsletter Signup Join the Ars Orbital Transmission mailing list to get weekly updates delivered to your inbox. Sign me up - CNMN Collection WIRED Media Group (c) 2023 Conde Nast. All rights reserved. Use of and/or registration on any portion of this site constitutes acceptance of our User Agreement (updated 1/1/20) and Privacy Policy and Cookie Statement (updated 1/1 /20) and Ars Technica Addendum (effective 8/21/2018). Ars may earn compensation on sales from links on this site. Read our affiliate link policy. Your California Privacy Rights | [privacyopt] Do Not Sell My Personal Information The material on this site may not be reproduced, distributed, transmitted, cached or otherwise used, except with the prior written permission of Conde Nast. Ad Choices