Mozilla to Apple: Protect user privacy with rotating phone IDs

Mozilla has criticized Apple for its latest privacy marketing campaign, urging it to provide more automatic protection for users behind the scenes. The nonprofit Mozilla Foundation has launched a petition to enhance a little-known feature in iOS devices that could make it harder for advertisers to track mobile users.

In a blog post, Mozilla praised Apple for its privacy track record but criticized its latest marketing campaign, with the slogan “Privacy. That’s iPhone.” The iPhone vendor has produced tongue-in-cheek videos showing people in various situations they’d rather keep private. Mozilla responded:

A key feature in iPhones has us worried, and makes their latest slogan ring a bit hollow.

Mozilla has a problem with the Identifier for Advertisers (IDFA), which is a hexadecimal code unique to every iPhone. When mobile users click a banner, play a video, or install an app, media companies can pass that information to advertisers along with the IDFA. The code doesn’t identify you, but it enables them to build up a profile of your activities.

The IDFA is a crucial tool in advertisers’ quest for attribution. This marketing concept ties individual product purchases or subscriptions to the advertisements that promoted them. The missing link is an individual’s series of responses to those advertisements over time. This is what the IDFA provides, and Mozilla finds it distasteful:

It’s like a salesperson following you from store to store while you shop and recording each thing you look at. Not very private at all.

Apple has sided with privacy advocates against advertisers before. In September 2017, it shipped IOS 11 with a new feature for the mobile version of Safari called intelligent tracking prevention. This feature, which also hit macOS Safari the same month, used machine learning to better manage cookies. These are small files, different to IDFAs, that websites and advertisers place in the browser to identify users later on.

Some sites use cookies to remember your session so you don‘t have to log in again. But others use it to tell advertising networks you‘ve been there, enabling advertisers to track you across multiple properties.

The intelligent tracking prevention feature works out which cookies make sites easier to revisit, and which of them spy on you. The original version blocked the latter from third-party use after a day and deleted them after a month.

Advertisers were so incensed by this that six major advertising groups published an open letter to the company calling it “unilateral and heavy-handed”.

Then, in June 2018, Apple updated the anti-tracking service, removing the 24-hour window for third-party cross-site trackers to use cookies in the browser. Advertisers protested again.

This should please privacy-conscious users, but the IDFA persists far longer than any cookie. In fact, it won’t ever change, unless the user intervenes. Mozilla explained:

Most people don’t know that feature even exists, let alone that they should turn it off. And we think that they shouldn’t have to.

Mozilla wants Apple to change the IDFA on its phones every month. This would still allow advertisers to track what you do on your phone, but only for a few weeks, instead of forever.

It is asking for this because most people don’t know about the IDFA or how to disable it, but now, you will. If you want to limit ad tracking via IDFA on your phone or tablet, go to Settings > Privacy > Advertising. Select the Limit Ad Tracking feature, and you’re done. This guide from Apple explains how to do the same on your Apple TV, and how to turn off location-based advertising on your iPhone, too.