[HN Gopher] Facebook and Snapchat iOS Apps Still Tracking Users ...
___________________________________________________________________
Facebook and Snapchat iOS Apps Still Tracking Users Despite Opt-Out
Author : tanelpoder
Score : 176 points
Date : 2021-12-08 16:02 UTC (7 hours ago)
(HTM) web link (www.macrumors.com)
(TXT) w3m dump (www.macrumors.com)
| celeduc wrote:
| Sounds like Zucker and Tim Apple made a _deal_.
| comeonseriously wrote:
| Not a deal, per se, but Apple is allowing this.
| tanelpoder wrote:
| MacRumors summary of the paywalled FT article:
| https://www.ft.com/content/69396795-f6e1-4624-95d8-121e4e5d7...
| jsnell wrote:
| The title seems inaccurate, and the outrage seems based on the
| title rather than the actual content. The article text explicitly
| says that the data is "anonymized and aggregated". How is that
| tracking?
| lilsoso wrote:
| Because it turns out that advertising networks and data brokers
| can de-anonymize the data with good success. How is that not
| tracking?
| [deleted]
| fauigerzigerk wrote:
| What the FT article claims is that Apple has shifted towards a
| much more lenient interpretation of App Store rules when it
| comes to user tracking. The original title is "Apple reaches
| quiet truce over iPhone privacy changes".
|
| What Apple means by tracking is linking data from individual
| app users to third party data [1].
|
| So in my view, it would indeed be a shift in Apple's position
| if they now accept that apps can link an individual's data to
| third party data as long as they somehow aggregate the result
| (e.g by creating cohorts) before actually targeting ads. But
| it's unclear to me whether they do in fact accept that.
|
| I think merely mentioning aggregation is not enough to
| determine whether or not Apple has changed its position on
| this.
|
| [1] https://developer.apple.com/app-store/app-privacy-
| details/#u...
| [deleted]
| nijave wrote:
| It seems in modern language any time data is uploaded from a
| device it's "tracking"
| rchaud wrote:
| Where's this 'outrage' that you speak of?
| throwuxiytayq wrote:
| _How_ are the apps still not removed?
| classified wrote:
| Can't let the addicts go cold turkey.
| bastardoperator wrote:
| I don't know why you're being downvoted. The sooner these
| apps die the better off society as a whole will be.
| twobitshifter wrote:
| The article says that Apple is allowing this behavior from
| developers - so I think the unhappiness should be addressed at
| Apple. Users clicked do not track but apps can still log your
| ip, and fingerprint you by your groups.
|
| > an unacknowledged shift that lets companies follow a much
| looser interpretation of its controversial privacy policy."
| Apple has instructed developers that they "may not derive data
| from a device for the purpose of uniquely identifying it," an
| unacknowledged shift that lets companies follow a much looser
| interpretation of its controversial privacy policy." Apple has
| instructed developers that they "may not derive data from a
| device for the purpose of uniquely identifying it," which
| developers have interpreted to mean that they can still observe
| "signals" and behaviors from groups of users instead, enabling
| these groups to be shown tailored ads anyway.
|
| >Apple has not explicitly endorsed these techniques, but they
| allow third parties to track and analyze groups of users
| regardless of whether or not they have given consent to user-
| level tracking. In addition, Apple reportedly continues to
| trust apps to collect user-level data such as IP address,
| location, language, device, and screen size, even though some
| of this information is passed onto advertisers.
|
| So this makes the do not track almost worthless. Few
| advertisers will say show this ad to John Doe who lives at 341
| maple avenue, but they will say things like show this ad to
| people living in Cincinnati between the ages of 20 and 30. And
| once you belong to enough ad groups, 6 or 7, you can be
| uniquely fingerprinted anyway.
| jjulius wrote:
| >... so I think the unhappiness should be addressed at Apple.
|
| I think the unhappiness should be directed at Apple _and_ the
| offending apps. There 's no reason why it can't be both.
| BbzzbB wrote:
| Apple fighting it on a technical level or playing tough in
| private negotiations is one thing, but do you truly expect
| Apple's customers would be pleased if Tim decides in their
| stead that Facebook, Instagram and Snapchat are off-limits?
| They have their own profit motives and you can be damn sure
| they will not hurt them in the name of a privacy crusade.
| Walling out small time apps with marginal use from your garden
| is a safe play, doing so with apps used by a crushing majority
| of your users is a whole different story.
| vanilla_nut wrote:
| It could be like Flash: everyone agrees it's awful, nobody
| wants to lose it on their device... but if Apple cuts off a
| large enough share of the market, it could be enough to cut
| down Facebook forever.
| antihero wrote:
| They don't have to take down the apps, just refuse to publish
| updates with the privacy violating features. This puts the
| ball in Facebook's court.
| DrBenCarson wrote:
| Exactly!
|
| 1. No updates released
|
| 2. No revenue released
|
| 3. An alert warning the user that the app is noncompliant
| and it's use could result in data theft (ie think self-
| signed SSL in the browser)
|
| 4. Restrict all network activity from those apps to the
| first-party domain
| nowherebeen wrote:
| They could just disable new device installs and allow
| existing users to continue using it. That would be enough to
| motivate them to correct behavior without causing an uproar.
| Existing users wouldn't even notice.
| BbzzbB wrote:
| Equally likely to be enough motivation for potential iPhone
| buyers to instead get a Pixel or whatever other top-end
| phones are made for Android. That seems like a more likely
| compass for Apple's decision making. Besides, when has
| there even been uproar that translated into material change
| of users behavior like an exodus? We're a bunch of self-
| selected nerds/geeks on this forum which makes us forget
| how much _people_ do not give a shit about privacy issues
| and other wrong-doings of the FAAMGs. If they do care, the
| threshold is either really hard to cross or the addiction
| /network effect too strong to move the needle. These
| controversies come and go - The Social Network, Cambridge
| Analytica, addiction/dopamine, Social Dilemma, Chinese
| interference (TikTok), censorship, election manipulation,
| terrorism funnels and countless other issues - but users,
| as an aggregate, they just come. Same way they never
| stopped buying iPhones despite suicide nets at Foxconn's
| factories or coffee made with child labor.
|
| What users would care about is if you'd tell them "No, you
| can't use these apps with billions of users on our phones".
| I'm ready to be proven wrong, but I'd take a bet Apple will
| not act on delisting or banning updates for Facebook &
| Instagram, that's wishful thinking in my book. Their morale
| high ground PR is clearly effective however.
| mrweasel wrote:
| Right, if Apple is serious about privacy they should give
| Facebook and Snapchat two weeks to comply and then just yank
| the apps. No extention, no exception, comply or your app is
| killed.
| jraby3 wrote:
| They seem serious about privacy but also their user
| experience. While that would be a win for privacy it would be
| a huge loss for most users. Apple also has a duty to
| prioritize user preferences.
|
| I'm saying this as a non user of any of the apps listed (I
| only use HN, LinkedIn and Reddit personally)
| jaywalk wrote:
| Clearly they're only serious about privacy until it could
| impact the bottom line. Despite the removals only helping
| users in the long run, removing two of their most popular
| apps (Snapchat is routinely #1 overall) would result in
| blowback towards Apple.
| mrweasel wrote:
| Yep, but let us also remind our self how stupid that line
| of argumentation is. Apple needs to let at least Facebook
| track us, if they don't Apple will lose millions of
| customers. Even if Apple truly want to be serious regarding
| privacy, the majority of their user base won't let them.
| jaywalk wrote:
| The vast majority of users don't really understand what's
| going on. All they'll know is that Apple pulled two apps
| that they use all the time, and they'll blame Apple for
| it. Yes, it's stupid, but it's the unfortunate reality.
|
| I do use Snapchat, but I would 100% support Apple pulling
| the app until they fall in line with proper privacy
| controls. Unfortunately I'm in the minority, and both
| Apple and Snapchat know this.
| VRay wrote:
| yeah, it's pretty frustrating, regular people on the
| street and even semi-technical people I talk to say "Oh,
| Apple is just as bad as all the others"
|
| They legitimately don't understand the difference between
| Facebook tracking every detail about your life and Apple
| having an account with your name on it
| comeonseriously wrote:
| Apple is _allowing_ this.
| brundolf wrote:
| So does this mainly come down to fingerprinting, as a replacement
| for traditional ad IDs (which should be blocked at a system level
| when you opt out)?
|
| If so, it seems solvable by Apple (through a combination of
| introducing noise/imprecision, and gating more things behind
| user-controllable app permissions)
| rchaud wrote:
| Switching to the mobile web version of Instagram on a UBO-enabled
| browser has been a gift of sorts.
|
| Because the website can't run in the background like an app, it
| can't preload anything. Launching takes a few moments to show
| posts, and videos don't autoplay.
|
| Any time the mobile website shows you a prompt to use the app for
| "an improved experience", they really just mean "for better
| tracking and personalized ads".
| d0m3 wrote:
| This.
|
| I've been working on native mobile apps in the last couple of
| years, and I realized the only reason companies want to push
| native apps is because they can do whatever they want with the
| tracking and 3rd party stuff in general.
|
| Seriously this native apps world is so backwards compared to
| the web...
|
| I'll take youtube as an example, on the mobile web app you can
| block most ads and you don't get the latest stupid features
| youtube is trying to push for some reason. Sometimes I'm
| brought back to the native app through a link and I'm shocked.
| The only reason I keep it is Chromecast support.
| chaircher wrote:
| How long have you been doing this and has it caused you to get
| locked out your account at all? I used to use instagram on
| desktop only but the account kept getting suspended, which
| stopped happening once I reverted back to using the mobile app.
| Anecdotally heard this was happening with other people too.
| Would be useful if mobile web was a work around?
| rchaud wrote:
| It's never happened, and I have 2 IG accounts, both running
| on FF Android.
|
| Best part of using it in a browser is that I can open links
| in new tabs. So I dont have that issue where going back to
| the homepage causes the feed to refresh.
| Implicated wrote:
| How did you go about getting it unlocked? Mine has been
| locked and now I suspect this is why, but I can't get any
| sort of response from Instagram in any way.
| throwaway946513 wrote:
| Not parent, but I've been using the mobile web variant for a
| while and have had no issues with my account being locked. In
| the past I have used the desktop browser on rare occasions,
| but a majority of the account activities are done through the
| WebKit Firefox (iOS).
| ekam wrote:
| Yes I've also gotten locked out of my account for using their
| website
| busymom0 wrote:
| Sorry, what's UBO?
| rPlayer6554 wrote:
| Ublock origin. It's an adblocker. It's best used on Firefox
| because iirc Chrome has been nerfing the APIs adblockers need
| to function.
| stevehawk wrote:
| uBlock Origin
| ItsYourBoi wrote:
| I am in no way surprised, but yet still disappointed. Come on
| lizard man, you have to do better than this
| elzbardico wrote:
| Is people still using Facebook? I've been using it less and less
| for the last year, and save one or two hyper engaged friends,
| most of my friends seem to have moved on from FB
| corobo wrote:
| I've found switching to the web version of social apps to be
| better anyway. Stops me visiting them as frequently if nothing
| else. I'm actively deciding to visit now rather than mindlessly
| opening the apps in order
|
| Feelin kinda smug right now
| rumblerock wrote:
| I've done a mild version of this with some success, putting the
| apps in a separate homescreen, or deleting them from the
| homescreen altogether so I'm forced to go into the app drawer.
| Unfortunately my mind still finds itself swiping down the iOS
| search bar to hunt for them. It really is a compulsive
| addiction of sorts.
| jraby3 wrote:
| Try doing it only in a private window so you need to login
| every time. Even better.
| jaywalk wrote:
| No option to do that with Snapchat. So if you want to be
| involved with Snapchat in any way, the app is your only choice.
| corobo wrote:
| Honestly the only time I've seen Snapchat in the past 5 years
| someone was using it to buy cocaine
| jaywalk wrote:
| Snapchat? How unprofessional, everyone knows that's what
| Signal is for.
| corobo wrote:
| I thought it was pretty opsec-poor myself but I wasn't
| going to get involved haha
| DrBenCarson wrote:
| You must not be a teenager
| corobo wrote:
| That is an accurate assessment doc, getting dangerously
| close to mid thirties
| hvgk wrote:
| At which point you are a winner anyway!
| trts wrote:
| It's been surprising how much I stopped thinking about social
| media entirely since doing this. Not to mention that the mobile
| web experience is often purposely crippled to try and funnel
| you back into native.
|
| Add in the need to get my timeboxed 2FA code to login and I'll
| begin to realize how little there is to gain relative to the
| trouble of actually logging in.
| beefield wrote:
| > timeboxed 2FA code
|
| Would you mind sharing implementation details?
| rPlayer6554 wrote:
| https://hackernoon.com/how-to-implement-google-
| authenticator...
|
| I haven't read through this in complete detail but it
| generally looks like the correct algorithm.
| HaloZero wrote:
| They also don't update the features a lot which has some perks.
|
| The calendar on events on facebook mobile website is a simple
| calendar that shows your events that you are invited to. The
| desktop and mobile app make it a pain to see just your friend
| events since they're pushing event discovery too.
| warning26 wrote:
| This! For this reason, Facebook Marketplace for mobile web is
| better than the app version, because it doesn't have the
| useless "ship to me" option that no one wants and no one will
| ever use (yet Facebook makes the default and resets after
| every search).
| [deleted]
| literallyaduck wrote:
| Severe fines starting with 25% of gross and making them pay for
| mandatory audits, coupled with jail for executives would mitigate
| this.
| DrBenCarson wrote:
| How much of FB revenue flows through the App Store though?
|
| Are you suggesting the US government would levy a fine?
| literallyaduck wrote:
| Users indicated they didn't want to be tracked. Wiretapping,
| and other stalking laws can be used for this, it isn't
| Facebook's first brush with the law so the fines should
| reflect that.
| mjparrott wrote:
| Jail for executives haha. Has this ever happened for anything?
| toomuchtodo wrote:
| China. Lots to take issue with, but when they want policy
| followed, they back it with force (Jack Ma, delisting Didi,
| forcing Evergrandes' founder to liquidate his wealth to make
| at risk stakeholders on shore whole).
| dfxm12 wrote:
| Enron. I guess the SEC takes things more seriously than,
| well, I'm not totally sure what government agency is
| responsible for protecting their constituency's private
| data...
| vmception wrote:
| It's a prisoner's dilemma. Regulators have been made scared of
| the concept of having a part in making a different monopoly if
| they cripple the existing near monopolistic companies.
| vanilla_nut wrote:
| Who cares? They can just topple them again, every time one
| company grows too powerful. Just like mowing my lawn: I don't
| complain that if I mow the grass, it'll come back. I just mow
| it every time it grows too high.
|
| It's all part of the churn, and the government has abdicated
| their role of monopoly lawnmower.
| swiley wrote:
| Do not run closed consumer software ever.
| Nextgrid wrote:
| The elephant in the room here is the GDPR. None of this is
| compliant (has never been) and yet is allowed to continue out in
| the open despite the regulation going into effect almost 4 years
| ago now.
|
| In fact, an argument could be made that Apple is complicit. Apple
| has a history of removing/rejecting apps that are used for
| illegal activities such as copyright infringement or even just
| breaking some company's ToS. Yet, they do nothing for apps that
| brazenly breach the GDPR.
| [deleted]
| jdvab wrote:
| Well, at least we have cookie banners.
| Nextgrid wrote:
| Just FYI, these are not compliant either, but the same
| problem above is the reason they're still around.
|
| A compliant cookie banner (or rather consent flow, as the
| GDPR covers more than just cookies) should not be annoying -
| it should be as easy to decline as it is to accept and dark
| patterns aren't allowed.
| outside1234 wrote:
| But they are allowed by the regulators.
| lmkg wrote:
| Facebook is incorporated in Ireland for tax purposes, as are
| many other US tech companies. This means that Facebook's GDPR
| violations are enforced by the Irish DPA. This is a conflict of
| interest for the Irish government: if they are not hospitable
| to US tech giants, they may lose their status as a favored tax
| haven. The Irish DPA has given all indications that it is
| compromised, and this is a sore point for the regulators in
| other major EU countries, notably France and Germany.
| comeonseriously wrote:
| Related: https://arstechnica.com/gadgets/2021/12/apple-reaches-
| quiet-...
|
| > Lockdown Privacy, an app that blocks ad trackers, has called
| Apple's policy "functionally useless in stopping third-party
| tracking." It performed a variety of tests on top apps and
| observed that personal data and device information is still
| "being sent to trackers in almost all cases."
| sneak wrote:
| Of course they are.
|
| If you don't want to be tracked by Facebook, _stop running their
| code on your device_.
|
| Apple provides you with the app privacy labels in the App Store.
| Read them and use them.
| iRobbery wrote:
| Without the apps they will track you too, no worries.
| DrBenCarson wrote:
| If I don't want Facebook code to run on my device, I literally
| can't use anything outside of stock OS offline.
|
| The Facebook and Google ads SDKs are in absolutely
| everything...it's how everyone makes money online.
| AlexandrB wrote:
| The "if you don't like it, don't user their product" crowd
| seems to be unaware of tracking pixels, shadows profiles,
| "like" widgets, reCaptcha, etc. Basically the last 20 years
| of adware "innovation". I'd love to be able to tell Facebook
| to DIAF and never run their code again, but for some reason
| they're not keen on respecting my wishes.
| sneak wrote:
| They're not in everything, just most large and popular
| things.
___________________________________________________________________
(page generated 2021-12-08 23:02 UTC)