Since removing IDFA on iOS, Apple has made it clear that probabilistic or fingerprint attribution is not allowed. Any method that lets an advertiser link users between apps is forbidden.
SKAdNetwork is available for download tracking but imposes privacy restrictions, making life harder for advertisers and ad networks. Consequently, numerous campaigns are still tracked by MMPs using probabilistic methods.
Knowing they may be operating on borrowed time, the ad tech world has waited with bated breath during each WWDC announcement and each iOS update to see whether Apple would enforce the ban. Here’s why a fingerprinting ban is needed and what form it might take.
Privacy protection over the years
In 2021, Apple announced that IDFA – used to gather extensive user profiles across multiple apps – would only be available if users agreed to share their data. This IDFA restriction was predictable, but it still sent shockwaves through the industry.
The adoption of SKAdNetwork (renamed as AdAttributionKit in iOS18) over the years has been slow and painful. To protect user privacy, Apple severely limits data available to advertisers, which makes optimization and LTV calculations extremely difficult.
By contrast, while IDFA is usually not available, probabilistic tracking is. It allows matching clicks and installs and gives advertisers detailed (and familiar) ROAS and LTV data. The obvious disadvantage is that probabilistic tracking is inaccurate, ranging from under-attribution in some cases to extreme over-attribution in others. It’s banned because it links a user across multiple apps, which is a privacy breach.
In 2023, Apple announced privacy manifests, which require developers to list third-party tracking domains in their app data so iOS can restrict access to those domains if the user hasn’t consented to data sharing. Given that there is still a significant reliance on probabilistic attribution, we can assume the majority of developers either complete their privacy manifests inaccurately, or the domains they are provided with are not the ones that are performing probabilistic attribution.
How Apple could stop probabilistic attribution
Before exploring Apple’s possible next steps to block this, it’s important to understand probabilistic attribution. Simpler than it sounds, it primarily relies on IP address matching: The IP address from the ad click is matched to the IP on the install.
Apple is likely looking at multiple options to shut it down:
- Enforce Privacy Manifests: Any connection to the internet has an IP address, which is how information flows back to the device correctly. This makes it very difficult for Apple to block it. The company could review privacy manifests and check connections of apps during the review process to see if they connect to an MMP.
However, it is very difficult to validate whether that connection is being used for attribution. Someone can argue that it’s just sending analytics data. Still, Apple may start scrutinizing privacy manifests and even start rejecting apps that have not declared their tracking domains accurately.
- Private Relay: Private Relay was rolled out in 2021 and provides a means for Safari users who pay for iCloud to route their internet browsing traffic via a relay, which means websites can’t see their true IP address. This is very similar to a VPN, but Apple has provided safeguards to ensure even they can’t see the sites you are browsing.
If Private Relay was enabled for apps, it would kill probabilistic fingerprinting immediately. However, routing all app traffic through Private Relay would require significant costs for Apple, as the volume of traffic would be huge.
- 24-hour post-install Private Relay: The challenge with Private Relay is the volume of data, but this could be solved by routing the traffic from an app through Private Relay for the first 24 hours after installation. This would reduce the traffic volume by over 99%, which might make it acceptable to Apple.
Probabilistic attribution usually has a 24-hour attribution window to avoid unacceptable inaccuracy, so this would also effectively kill fingerprinting.
- Do nothing: Apple could keep the status quo – state that fingerprinting attribution is not allowed, but not actively enforce the ban at scale. Nontechnical enforcement is open to legal challenges and arguments over definitions, and there are some big players in advertising.
Apple may choose to watch and wait while they consider their options. The downside is that, while they do so, they’re unable to enforce their own rules. It’s likely that, until the rules are enforced, advertisers will continue to use fingerprinting, and even the biggest networks will include IP addresses in their attribution modeling.
So, what will Apple do? Some advertisers have adopted SKAdNetwork (now AdAttributionKit), some have experimented with it, and some have ignored it. The big question is, if and when Apple enforces a block on probabilistic attribution, will it be a cliff-edge change for the industry or something they will phase in via an OS update?
Advertisers should be prepared for anything.
“Data-Driven Thinking” is written by members of the media community and contains fresh ideas on the digital revolution in media.
Follow Dataseat and AdExchanger on LinkedIn.
