Does Apple's Tracking Transparency Policy Affect My App?
Written by Lia Millard on June 07, 2021
With the release of iOS 14.5, apps that track user data will have to ask the user’s permission to do so. But how does Apple define “tracking”? And what are the implications for your iOS, iPadOS, or tvOS application?
Disclaimer: This post is not a legal interpretation nor a statement of Apple policy. You are responsible for making your own decisions around data practices in your app. Head over to Apple’s website to read the policy in its entirety.
Now that that's out of the way...
Apple's Definition of Tracking
Let's look at Apple's User Privacy and Data Use documentation directly:
Tracking refers to the act of linking user or device data collected from your app with user or device data collected from other companies' apps, websites, or offline properties for targeted advertising or advertising measurement purposes. Tracking also refers to sharing user or device data with data brokers.
(Source, emphasis mine)
Here’s a simplified decision tree to break down that definition:
If you made it to an orange bubble in the above tree, you probably need to ask the user for permission to track.
A watchout: You are responsible for all code included in your app, even if you didn't write it. If your app uses a package that tracks user data, Apple says you must ask the user for permission first.
How is Apple enforcing the policy?
The OS will return all zeros for the device’s advertising identifier (IDFA) unless the user has granted permission. The IDFA is unique to a device and does not change for the lifetime of the device unless manually reset by the user.
Of course, if you fail to follow their rules, Apple reserves the right to reject your app from the App Store.
What does it look like to ask a user for permission to track?
To request permission to track, your app will trigger an OS alert, pictured below. The “purpose string” (the not-bold text below the question) is customizable.
How often do users refuse tracking?
According to Ars Technica, most people refuse it:
US users choose to opt out of tracking 96 percent of the time in the wake of iOS 14.5.
What if I use a third-party service for analytics?
Check out that decision tree again. Are you using the service to link your user data to data from another company for advertising purposes? If yes, then you are probably tracking user data according to Apple's definition.
I use a customer relationship management (CRM) service to collect user data from my app and website. Is that considered tracking?
Probably not. You own the user data from your mobile app and the website, even if you use a third-party service to collect and/or store that information. To ensure compliance, it's a good idea to verify that your CRM is not sharing your data with anyone else.
I've got more than one application in the App Store and link user data between them. Is that considered tracking?
Probably not. Again, you own the user data in both apps. If you had been using the IDFA to link data, think about using the vendor identifier (IDFV) instead. Learn more about the IDFV from Apple's documentation.
Apple will likely continue to add privacy-focused features to iOS and increase consumer awareness. In fact, they've already announced more privacy-focused features for iOS 15. As consumer awareness grows, companies and products that protect privacy will have an advantage. Choosing technical solutions that protect users' privacy is a strategic decision for developers. That’s how we can build great digital products - by putting our users, including their privacy, at the center.