Schneier on Security

A blog covering security and security technology.

« Master Keys | Main | Studying Zero-Day Attacks »

October 15, 2012

Apple Turns on iPhone Tracking in iOS6

Previously, Apple had all but disabled tracking of iPhone users by advertisers when it stopped app developers from utilizing Apple mobile device data via UDID, the unique, permanent, non-deletable serial number that previously identified every Apple device.
For the last few months, iPhone users have enjoyed an unusual environment in which advertisers have been largely unable to track and target them in any meaningful way.

In iOS 6, however, tracking is most definitely back on, and it's more effective than ever, multiple mobile advertising executives familiar with IFA tell us. (Note that Apple doesn't mention IFA in its iOS 6 launch page).

EDITED TO ADD (10/15): Apple has provided a way to opt out of the targeted ads and also to disable the location information being sent.

Tags: cell phones, privacy, tracking

Posted on October 15, 2012 at 1:21 PM • 25 Comments

To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.

Comments

Craig • October 15, 2012 1:34 PM

Apple introduces iOS6, and you'll know why 2012 will look very much like 1984.

Ryan • October 15, 2012 1:37 PM

This is what you need to be providing here:

"How to opt out of interest-based ads from the iAd network"
http://support.apple.com/kb/HT4228

You have to go to a link FROM YOUR IPHONE to disable the tracking. For brevity (and those who did not go to the support site), the opt-out site is http://oo.apple.com

Wayne • October 15, 2012 1:37 PM

Oh the irony... Someone needs to redo the Apple 1984 ad.

Ryan • October 15, 2012 1:39 PM

Also, if you use Verizon, there is a separate link to disable Verizon's context-and-location-based information sharing: https://wbillpay.verizonwireless.com/vzw/secure/setPrivacy.action (requires login)

matt • October 15, 2012 2:03 PM

we use galexyS3

stvs • October 15, 2012 2:18 PM

Firewall iP: http://yllier.webs.com/firewall.html

kashmarek • October 15, 2012 2:35 PM

re: 1984 comment...

we have found the enemy and it is Apple.

it prompts • October 15, 2012 2:52 PM

When I upgraded to iOS6 over the air, it prompted me about the Ad tracking so I was able to turn it off (or rather, turn on the limit) right away. So people knee-jerking about 1984 need to chill.

Furthermore, it is not the same as Verizon's tracking. It assigns a randomized non-permanent and non-personal number. It lets advertisers track a party who is interested in their wares, but does not let them know it is you.

neuroelectronic • October 15, 2012 2:58 PM

What's with the FUD Bruce?

The new "virtual UDID" system has been covered in detail previously. How is it surprising they've turned it on in iOS 6?

adbert • October 15, 2012 3:46 PM

So, I just went there with my iPhone 4S running iOS 5.0.1 and opted out. Then I did it again moments later and it said I've already opted out.

Great, right? Here's the problem:

I was already at this site and opted out with this very same phone on iOS 5.0.1 months ago.

In other words, I was involuntarily shoved back in at some point. I'm sure it will happen again -- note that there is no word on how long this opt-out lasts...

iAd has corrupted Apple. Now that they sell advertisements, you are not just their customer, you are their product.

ryan • October 15, 2012 4:17 PM

Advertisers have always been able to track users even without the UDID (which is still being widely used). There are other options including the MAC address or pasteboard options such as OpenUDID and just plain IP Address. Until Apple really cracks down and rejects any app who use any possible method then there is an option for people to use then advertisers will have their way. These changes are just meaning they have to change their methods.

Randy • October 15, 2012 4:55 PM

...and, of course, Apple is hoping that many people either don't opt-out or forget to or can't remember how to.

onearmedspartan • October 15, 2012 4:59 PM

@ Craig
Your comment is brilliant, Sir.

@ adbert
Interesting comment, thanks for sharing.

Sam • October 15, 2012 5:30 PM

"For the last few months, iPhone users have enjoyed an unusual environment..."

This is false. The number/percentage of app submissions that were rejected after Apple announced the deprecation in iOS 6 is completely unknown to the public. I for one submit monthly (or more often) updates across 2 iOS applications and despite sending UDIDs to 4+ ad networks, I've never been rejected.

As soon as Apple announced the deprecation, Ad networks and others immediately began development of workarounds using one of many other unique or semi-unique identifiers. But, even as I write this and after the recent release of iOS 6, ad networks are leveraging both UDID and (most commonly) a new MAC-address based "inventories."

I can't imagine we're going to be able to prevent developers and tracking platforms from targeting users based on their activity and unique metadata. In fact, in a world were huge Internet companies rely on targeted advertising for monetization, you could argue it's a required entrance fee.

Tinfoil 2.0 • October 15, 2012 5:43 PM

I don't believe this is correct. At the Apple link, Apple says: "Opting out applies only to Apple advertising services and does not affect advertising from other advertising networks." Users need to realize that Apple's iAd network, and its associated "opt-out" [https://support.apple.com/kb/HT4228?viewlocale=en_US&locale=en_US], is a separate beast from the subject of the Business Insider article, which covers 3rd-party ads and ad networks used by 3rd-party apps.

P.S. I almost always use "opt-out" in quotes because it usually signifies that Targeting gets turned off, but unfortunately it does not guarantee that data is no longer being collected [Tracking].

Figureitout • October 15, 2012 5:44 PM

Isn't the whole point of a cell phone to be able to locate the phone and provide service/comms?

I'm not so sure clicking a button to say "I opt out", will really stop the trend.

stvs • October 15, 2012 6:55 PM

Apple has made turning this off intentionally deceptive. And there's another location-based service setting. In addition to visiting http://oo.apple.com, do this:

iOS 6:

Settings>General>About>Advertising>Limit Ad Tracking ON

"The tracking control is titled "Limit Ad Tracking," and must be turned to ON, not OFF, in order to work. That's slightly confusing — "ON" means ads are off! — so a large number of people will likely get this wrong."

Settings>Privacy>Location Services>System Services>Location-Based iAds>OFF

IOS 5:

Settings>Location Services>System Services>Location-Based iAds>OFF

Natanael • October 16, 2012 2:50 AM

On all my Androids, this setting is made once per device through Android Market Google Play. And it covers all of Google's tracking/ad personalization. AFAIK.

John • October 16, 2012 4:05 AM

I'm not sure why people are surprised that the iChurch is exploiting their followers.

If you don't want to be tracked then don't carry a network connected computer.

Winter • October 16, 2012 7:35 AM

"and also to disable the location information being sent."

I have heard (no citation available) that location tracking is not actually "disabled", but that a kind of "Do not use" flag is set. Developers are politely asked to honor that flag.

Darwin • October 16, 2012 12:08 PM

Bruce you didn't do your homework on this as you can see from the comments.
There are two types of tracking and both can be turned off.
No way to turn such things off on Android devices for all the Android whiners. Not on individual apps which are not checked anyway and certainly no way to turn off Google's tracking of everything you do. Thats because with Android you are the product not the device. Fun right?
Apple gives you a way out and does not sell your data. They will also remove apps that violate location services and do not track.
Pretty hilarious that the Android kids see this as another chance to whine about Apple when Google is FAR worse in every regard.

Nick P • October 16, 2012 1:56 PM

@ John

"If you don't want to be tracked then don't carry a network connected computer."

Quite unreasonable in this day and age. Hence, the push for legislation & privacy protections.

Also, you can be tracked digitally & physically without a "network connected computer." The Tagging, Tracking and Identification technologies will only get better over time. Which leads us back to legislation & government accountability...

Figureitout • October 17, 2012 12:07 PM

Quite unreasonable in this day and age.--@Nick P. No, it just takes discipline. Carrying a comp. w/ you everywhere doesn't necessarily make you more productive, it makes you more reliant on technology, which has become inherently untrustworthy as PCB's are too miniaturized to fix and software too bloated to give a damn about.

Which leads us back to legislation & government accountability...
--Which will lead us to failure. There are few things I can say with such certainty.

joe gallo • October 18, 2012 11:08 PM

this is definitely a misstep from apple, and we are seeing more and more bad decisions from apple lately. their design and engineering teams are strong enough to keep them at the top for a while longer, but this should be a good barometer of their corporate culture / leadership. it's not encouraging.

Andrew • October 19, 2012 1:28 AM

This may be of interest:
https://developer.apple.com/library/ios/documentation/AdSupport/Reference/ASIdentifierManager_Ref/ASIdentifierManager.html

If the user has limited ad tracking, use the advertising identifier only for the following purposes: frequency capping, conversion events, estimating the number of unique users, security and fraud detection, and debugging.

So it seems that disabling targeted ads won't necessarily disable tracking.

Post a comment

Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.

Subscribe via Kindle

Blog Menu

Search

Powered by DuckDuckGo

Blog Home Page
100 Latest Comments

Archives by Date

2013 J F M A M
2012 J F M A M J J A S O N D
2011 J F M A M J J A S O N D
2010 J F M A M J J A S O N D
2009 J F M A M J J A S O N D
2008 J F M A M J J A S O N D
2007 J F M A M J J A S O N D
2006 J F M A M J J A S O N D
2005 J F M A M J J A S O N D
2004 J F M A M J J A S O N D