Apple Update: Subvert Safari’s Tracking Rules and You’ll be Treated as Malware

Apple Update: Subvert Safari’s Tracking Rules and You’ll be Treated as Malware
Wednesday, August 21, 2019
Michael Kerr

The murky issue of user trust and tracking in digital marketing is making headlines again. This time, Apple has updated its own tracking method in a move that is sure to compel vendors to rethink how they track users.

Most vendors use a range of cookies to track users, with a view to not only aid reporting and performance but also deliver a more personalized browsing experience. Historically, Apple has been keen to protect its user base and limit the amount of tracking users are subjected to. Back in 2017, they began blocking third-party cookies such as Facebook, Google, and other ad vendors. To counter this, vendors managed to create third-party cookies that mimicked the functionality of first-party cookies and allowed for tracking to continue.

But Apple has continually reviewed and updated its “ITP” settings (“Intelligent Tracking Prevention”) over the last two years. Now they’re announcing measures to make it harder for ad vendors to circumvent Safari’s built-in anti-tracking rules.


Apple’s anti-tracking manifesto

  • “If a party [third-party vendor] attempts to circumvent our tracking prevention methods, we [Apple] may add additional restrictions without prior notice. These restrictions may apply universally; to algorithmically classified targets; or to specific parties engaging in circumvention.
  • In effect, any ‘workaround’ for Safari will be treated with the same seriousness as exploitation of security vulnerabilities.
    • This includes link decoration—extra components in a URL that pass information to the destination site—often used by social networks
    • Effectively, any third-party vendor trying to bypass Apple’s built-in anti-tracking features will have their sites treated like malware
    • If detected, then this could result in tracking/cookies being reduced/blocked

Are my ads affected? What should I do?

Apple’s actions will have a significant impact on the tracking settings of vendors such as Google and Facebook, as well as reporting suites that rely on cookies to track users. Vendors have previously countered similar measures by updating their internal tracking to comply, and we fully anticipate tracking parameters to be further adjusted in light of Apple’s move so that a significant portion of their user base will continue to be tracked as before.

Of course, there is a wider discussion as to the pros and cons of vendor tracking of users. On one hand, it allows websites to tailor their experience and provide a free service in many cases. On the other, many users may feel uncomfortable being “watched” and served such content, so marketers have a fine line to tread (but it is possible to respect privacy in the digital age!).

For now, there is no immediate impact on websites and tracking. Expect each major vendor to react swiftly and refine their tracking methods if Apple’s update looks likely to have an undesired impact on their user base.

For additional detail and context, look no further than the official Apple WebKit announcement.