Apple's new anti-tracking system will make Google and Facebook even more powerful

The internet is an ad-tracking machine. It’s been true for long enough that we rarely talk about it anymore, but it bears repeating. For all the free speech and free information, nearly any site you visit will come with a dozen different tracking cookies, enabling uniquely tailored ads to follow you from site to site. Targeted advertising is still the best way to make money on the internet, so those cookies are everywhere. (The Verge is no exception; that VR room isn’t cheap.) Sites try not to be creepy about it, some harder than others, but the overarching logic is hard to escape. It’s a multibillion-dollar business, and it pays for nearly everything you see online.

Yesterday at WWDC, Apple threw a wrench into that system. Alongside new autoplay blockers, the latest versions of Safari (currently in beta) will have a new tool for blocking third-party ad trackers, aggressively identifying and blocking any cookies used to track users across the web. As Craig Federighi said onstage, “It’s not about blocking ads, but your privacy is protected.”

It’s an important move, particularly for the mobile web, where Safari manages just under 30 percent of browsing sessions. When Safari added the option for ad-blocking with iOS 9, it was a day of reckoning for many web companies — raising hard questions about the future of mobile browsing. This week’s announcement is primed to make a similar splash.

According to Marc Al-Hames, who works on the privacy-focused browser Cliqz, companies are already scrambling to figure out the best way around the new restrictions. “This is a cat-and-mouse game, and it always has been,” Al-Hames says. “Users try out different things to protect themselves, and there’s a multibillion-dollar ad tech industry thinking of ways to circumvent it.”

Surprisingly, Google and Facebook are poised to come out of that game ahead. But to understand why, we need to dig into how the new policy works. Safari has had some version of cookie-blocking for years, but the previous default was to allow cookies “from websites I visit.” The new policy goes further, using machine learning to identify tracking behavior no matter how the cookies are served. In many cases, blocking those cookies outright would break basic functionalities. Instead, Safari puts a strict time limit on how long the cookie can stick around, keeping cookies available for 24 hours after a visit and outright deleting anything older than 30 days.

The crucial distinction is between the first-party sites you’re purposefully visiting and the third-party trackers that come along for the ride. As long as a cookie is associated with a website you’ve visited in the last 24 hours, Safari won’t change much — which gives popular sites like Facebook and the various Google services an easy way around the new restrictions. The systems hit hardest by Safari’s new policy will be third-party systems like Criteo or Adroll, which silently coordinate cookies in the background of thousands of sites. Not coincidentally, Criteo’s stock plummeted in the wake of the announcement.

That’s much less of a problem for Google and Facebook, which already dominate online ads. Most people visit Facebook or a Google service every day, and those users will never be too far outside the 24-hour window. Both services also work as a kind of permanent login, used to access sites like Twitter or WordPress without a separate password. As a result, most users stay logged in to Google and Facebook as long as they’re online. Combine that with omnipresent Like buttons, and you’ve got an easy way to see what people are doing on the web. And as long as you’re visiting Facebook once a day, Safari won’t get in the way of that tracking.

Google and Facebook’s biggest challengers in ad-targeting are telecom companies like Verizon and Comcast, which were given a huge boost by recent shifts in US telecom policy. But those companies should fare just as well. Both Verizon and Comcast invested heavily in web media alongside advertising tech, which means they can take advantage of the same first-party exception as Google and Facebook. (Disclosure: One of Comcast’s media investments is a minority stake in Vox Media, parent company of The Verge.) As long as you’re visiting AOL or Huffington Post sites once a day, Verizon will have no problem targeting ads, and cookie-serving deals may extend that reach even further.

At the same time, ad networks that aren’t attached to popular websites will take a serious hit. It won’t be a total blackout, since most modern networks supplement cookies with more advanced fingerprinting techniques that profile visitors without transmitting any data. They can also try to make cookie-serving agreements with websites, collecting data at the same time that they serve the ads themselves. But the new Safari policy will still put those ad companies at a permanent disadvantage to more powerful players like Google and Facebook. Those companies were already outmatched — with Google and Facebook capturing 90 cents of every new dollar spent on online ads — and the new browser moves will make it even harder for them to survive. The result will tip the balance even farther toward the handful of giant companies that already dominate the web.

Apple isn’t the only force pushing the web in that direction. The European Commission’s recent anti-tracking proposals would establish a similar distinction between first and third parties. Only last week, Google announced an ad-blocker for Chrome that’s likely to edge out small players even further. It’s still hard to say what that will mean for smaller websites and everyday users, but Google and Facebook will only become more central to the business of the web.

Underneath it all is the basic logic of consolidation. These players — Google, Facebook, Verizon, and Comcast — control huge portions of how we connect to the web, from the servers to the fiber to the device, ending with the browser itself. Now, they’re using that control to play for advantage in ad-tracking, with users stuck in the middle. iOS and Safari are incredibly powerful tools in that fight, and by all appearances, Apple is using them to try to craft a less invasive web experience for its users. But after more than a decade of ad tech, untangling that knot may be harder than the company realizes.


plummeted? it decreased ~5%. a case of the unlabeled y-axis

This is a good thing. Ad-based companies that provide good enough free services for users to justify being logged in at least once every 24 hours aren’t affected much, and shitty advertisers who don’t provide anything of value to users (apart from ads themselves) get hammered. Furthermore, the large ad-based companies (Facebook, Google) usually serve better quality ad tech that is less annoying than what shittier third parties serve (obtrusive, in your face, hard to close, etc). I see this as a win for everyone. The pendulum swung too far in the favor of ad tech on the internet and now it’s time for it to swing back in favor of usability.

What’s more, Verizon and Comcast having the benefit of being able to identify you via their cellular network (with recent policy shifts that allow them to not offer an opt-out) puts them in a further advantage against other companies, doesn’t it?

They don’t even need cookies, they already have your sessions in a DB stored procedure

It’s good. Imagine the Hell on Earth of ads that will unleash when everyone will constantly wear AR devices (that day is much closer to us than it may seem today).

Products and "special offers" will literally follow you then.

Those companies were already outmatched — with Google and Facebook capturing 90 cents of every new dollar spent on online ads — and the new browser moves will make it even harder for them to survive.

Maybe it’s a good thing that Comcast and Verizon will enter the ad space. It sounds like Google and Facebook could use a little competition.

Maybe it’s a good thing that Comcast and Verizon will …

When the solution to combating a dick is by enlisting an even bigger dick…

This means nothing as you said since tracking just goes server side and there are other ways to address devices. So, no real privacy gains here. It just seems like a crude marketing ploy to attract users back to safari under the illusion of privacy protection. Which is fine by me mind, they aren’t making anything worse.

My thoughts too. This is just a sound-bite by Apple marketing with little real end impact to users.

Similar in some ways to the announcement that their in home speaker only sends data to a server once it hears the key phrase. The way they phrased it made it seem like the competitors were constantly monitoring your conversations, but really this is just basic efficiency and common sense. It reads as, wow, Apple really cares about my privacy.

"illusion" of privacy protection?

Apple’s business model is not "selling your personal information/behavior to target ads and make money". Facebook and Google’s is. That’s a fact, not an illusion,

Nobodies business is selling your personal information/behavior. I don’t think you understand how advertising works.

Malicious actors in either company have (and will continue to) so long as it is profitable. The companies try to keep it quiet, but so long as a party have that information, there exists the possibility of reasons for it. That’s not to say I don’t use the services, but I’m aware of the risk.

On a more proper level, they don’t sell your information directly, but sell access to you based on your information that fits the criteria of the buyer.

Can someone please explain how these server-side tracking systems work?

I’m a bit disappointed with The Verge, here.

You focused wholly on the impact to business models but failed to go into how it might benefit (or even hurt) the end user.

So, a big company says ‘your privacy’ is protected. Cool. Thanks.

Is it really ‘safer’ or are they just saying that?

Should I forego ad blockers? Does that mean the mobile web will feel slower?

This is surely connected to the removal of "Social Accounts" from always-on settings. Does that mean I will now have to manage more logins?

Does this mean that more of my favorite sites (e.g., The Verge, Re/Code) will have to consider a pay model like NYT, WSJ or WaPo?

Come on, The Verge, make it matter to us humans.

What corrupted pussies, they block add network competition but let big corps (meaning 95% of adds) still track you via 24h loophole.

Freaking block all 3rd party cookies by default on all browsers and be done wiht it.

Due to all of the incessant tracking and privacy intrusion, I gave up using Facebook years ago, and changed my Web searches from Google to DuckDuckGo.

Just because we (most people) are unaware of how pervasive the online services from these two companies can be, it does not mean that we should be complacent about giving up tons of our personal data behind the scenes.

I did the same, getting a bit tired of being tracked everywhere.

Privacy or pay. There’s no middle ground.

If you want privacy, you don’t get free internet. If you want free internet you don’t get privacy.

The issue is that on the vast majority of sites, you don’t a pay option.

I believe it would drive a large portion of their traffic away if it was required, and if you charge for a privileged version you won’t get as many people paying as you’d think.

I do not want to pay a yearly subscription to 50 websites every year, im much more comfortable having Google know I searched for Razer laptops at some point. and I don’t use Facebook, so there’s that.

The problem is, if you don’t want tracking you’re going to need to pay for every website that you have, do, and intend on visiting. Otherwise it’s null. 100% of websites or you’re tracked, which defeats the purpose entirely.

We pay for access to the internet thru providers, carriers, etc but we do not pay for the content, mostly.

Woo. Big moves Apple, big moves. Will be watching

I’ll never understand why anyone is afraid of tracking data being used to serve you ads you’re interested in in exchange for services you’ve come to rely on for daily tasks and information…

Nothings free in life people.

No one is afraid of an opt in service like that. People are afraid of that data being used or stolen by 3rd parties that you did not consent to give to. That would be giving valuable data away to others that could only use that data against you because they have no intention to offer real services to you.

Now that VPN ad-blockers aren’t allowed to be updated, I’m hoping Apple doesn’t apply this rule to the VPN apps aimed at blocking ad-trackers like Disconnect Privacy Pro from the AppStore. Because while I like the fact Safari will block ad-trackers by default in iOS 11, I would also like the option to block ad-trackers in apps as well. I dont mind unintrusive ads in apps as long as their ad-tracking ability is shut down. Also not sure how the new Safari ad-tracker blocker will make Google and Facebook more powerful. It won’t encourage people not to use Safari ad-blocking extensions. Since most who use ad-blockers do it to block ads not to for ad-tracking blocking. As long as people can see ads, they will use ad-blockers until Apple bans Safari extensions that block ads. So if anything this iOS 11 feature in Safari will hurt Google and Facebook even more not make them more powerful.

View All Comments
Back to top ↑