iOS 14.5 limits (and opens) app tracking


24.02.2021

For the upcoming iOS 14.5, Apple has announced some tracking limitations on iOS apps. Many blog posts mix the iOS 14 tracking restrictions with tracking restrictions on Facebook. Although these are related topics, they are completely different. This post is “only” about the impact of iOS 14.5 on tracking (and a new possibility) - at least what we know so far - so let's take a closer look. First the bad news (for tracking).

Tracking Opt-In for iOS apps

With iOS 14.5 Apple requires all apps to get permission for the tracking of the user:

Source: Twitter Stream of Tim Cook

So a kind of Consent Management for app tracking. If we're honest, it's long overdue. Consents banner on website (for third-party tracking and cookies) are now very common, but smartphone apps keep tracking as usual. But back to business ...

In any case, the user can choose whether he wants to be tracked or not. Probably more than half of the users will not allow tracking, which means that we lose a lot of tracking data. At least at first glance. Apple calls the whole thing “App Tracking Transparency Framework”, in short ATT, and sees it as part of its Data Privacy Strategy.

But there is also a new way for tracking iOS apps:

iOS conversion tracking without Opt-In

If you dig a little deeper, you come across a "Webkit Feature", which Apple also rolls out from iOS/iPadOS 14.5 for Apps. It's called “Private Click Measurement”, PCM for short. With this, Apple offers the option of at least tracking conversions, even if there is no consent for tracking from the user. Apple justifies this with the fact that the conversions are transmitted anonymously and do not allow any conclusions to be drawn about the user or the device.

And Apple is making a lot of effort here, because the following restrictions apply to this new way of conversion tracking:

  • There is no user mapping possible and therefore no capturing demographic User features
  • The time of the conversion is transmitted, not the time of the ad click
  • The attribution reports are transmitted with a delay, randomly in a time window between 24 and 48 hours after the respective event (or even later when the user browser is running again)
  • With an ad-click, an 8-bit ID can be transmitted (a number between 0 and 255, i.e. 256 possible values / campaigns) - per domain
  • For a conversion, a 4-bit ID is transmitted (a number between 00 and 15, i.e. 16 different types of conversion) - per domain
    A kind of priority specification should also be possible later here
  • The attribution window is a maximum of 7 days, i.e. if the conversion takes place later than 7 days after the ad click, it will not be tracked

The “Private Click Measurement” is, as already written, a feature of Webkit, so it is not only available in apps, but also in Webkit browsers such as Safari. The whole thing was proposed as a standard at the W3C, so one hopes for support in the other browsers as well.

However, Google, Brave, Facebook and a few others already have their own solutions in mind that compete with PCM. It's sure to be exciting here (at least for browser tracking).

For tracking banners that advertise other apps from the app store, Apple offers the SKAdNetwork. This means that e.g. the installation of an advertised app can be advertised as a conversion.

Conclusion

According to Apple, all apps that are offered in Apple’s App Store are affected. This would theoretically also affect browsers such as Google Chrome. This would make the topic even more exciting. You should also keep in mind that many apps (e.g. Facebook) also have in-app browsers, which are equally affected. Only Apple’s Safari is not (officially) subject to this restriction, because it is not an app listed in the App Store. However, Safari has a special position in terms of Data Privacy (see ITP).

In summary (and in simplified terms) there are the following effects (regarding tracking) with iOS 14.5:

  • Opt-in for user tracking in iOS Apps is for all apps duty
  • Conversions can be tracked only limited (max. 256 different campaigns and 16 different kinds of conversions, each per domain)
  • The attribution window (between ad click and conversion) is shortened to 7 days (from 28 previously)
  • Demographic or geographic tracking metrics are no longer possible (without opt-in)
  • Ad views can no longer be tracked, at least not without an opt-in

Depending on the type and scope of advertising campaigns, the iOS update will have a significant impact, especially for social media campaigns in Facebook & Co. Here, some will certainly have to adapt or even change their advertising strategy.


Update 02/24/2021, 4:30 p.m.
Note to SKAdNetwork added


Autor:

Andi Petzoldt