Good to see somebody talking sense. Lots of journalists jumped on this, framing Apple as evil. At a high level, the whole thing is no different to a website using a cookie to keep you logged in.
But cookies I can choose not to allow, right?
Oh, the Places Your Apple ID Will Go
11–20 of 164 posts
Re: Oh, the Places Your Apple ID Will Go
#12Can someone explain why the App Store doesn't show the "Ask App Not To Track" dialog? Why do 3rd party apps have to ask for permission to track, but Apple's apps do not?
Tracking is about following breadcrumbs across activity in third party apps. So if the Facebook app uses identifiers in common with Uber, and can see what you do in Uber or something, that’s tracking. Recording what you do in a single app, or apps from one company that isn’t strictly necessary for providing the service is telemetry.
Apple doesn’t share user data and identifiers with third parties except as necessary to provide specific services, so it doesn’t track. It does record telemetry though, most of that is in a non personally identifying way, but some of it can be traced to a user.
Obviously identifying information necessary to provide a service is different. If I buy an app off the App Store, they need to identify who bought it. The edge cases are things like, do they need to know I searched for fitness apps on the App Store and associate that with my ID. Amazon does on their web site so they can show ads related to my recent searches, but it’s not strictly necessary for providing the service.
Re: Oh, the Places Your Apple ID Will Go
#13I see a lot of very intelligent people here unable to agree upon a
matter that seems, in essence, simple enough.
That is in itself troubling and partly answers a question.
If developers on Hacker News cannot fathom whether Apple deceptively transmitted PII, or whether zealous journalists are over-egging the pudding, then we have another problem.
Obfuscation is a form of deception through complexity. It can be hard to tell from the outside whether that complexity is "necessary" and whether its ill effects are deliberate or accidental.
Nevertheless, it remains a form of deception if you present a system as simple, with controls that apparently do understandable things as a front for another system that even you, as a developer, no longer understand. This same theme is coming up in AI, social algorithms, moderation/censorship of speech. We are muddying the waters in the hope that people believe they are shallow.
Re: Oh, the Places Your Apple ID Will Go
#14Good to see somebody talking sense. Lots of journalists jumped on this, framing Apple as evil. At a high level, the whole thing is no different to a website using a cookie to keep you logged in.
But cookies I can choose not to allow, right?
Well yeah, your browser, your rules; it'll just come at a convenience fee of having to log back in every time, and that for the duration of your session you HAVE to have a cookie or your login won't work. There used to be an alternative of a session ID in every URL, but I haven't seen that in years.
Re: Oh, the Places Your Apple ID Will Go
#15Can someone explain why the App Store doesn't show the "Ask App Not To Track" dialog? Why do 3rd party apps have to ask for permission to track, but Apple's apps do not?
There's probably a line in the T's and C's that nobody reads when you first start up the phone where you give them permission. Reading the other comments, it will be in there if they even need to ask; on websites, websites do not need to ask for permission for functional cookies.
Re: Oh, the Places Your Apple ID Will Go
#16Good to see somebody talking sense. Lots of journalists jumped on this, framing Apple as evil. At a high level, the whole thing is no different to a website using a cookie to keep you logged in.
A cookie is not a PII identifier, it is an "identity discriminator".
In other words cookies let them tell you the _same_ person 104898 that was already here in March, welcome back!, and not any other person e.g. 298472, but without telling them your actual name etc.
In contrast, a PII identifier is a unique ID that is linked to personal attributes in real life like a person's name ("John Doe"), address ("6400 Boulevard Court, Beverly Hills, CA"), e-mail address ("john.doe@acm.org") or credit card number ("VISA 4879 5223 6537 9935").
So, this is indeed different from visiting a Website that places a cookie.
Re: Oh, the Places Your Apple ID Will Go
#17Earlier quoted context omitted.
If it can be traced to a natural person, it is PII. IP addresses are PII, ids are PII. It is in the name "Personally Identifiable Information." If it can be used to personally identify you, it's PII. If you gave me this ID number, I could use it to locate your information in breached db dump, or if it is used in API requests, impersonate you.
> or if it is used in API requests, impersonate you You're suggesting it's an authorization token - which it obviously is not.
depends on the authentication mechanism
Re: Oh, the Places Your Apple ID Will Go
#18> I may be getting something wildly wrong here, but I am not sure I see the presence of this Apple ID proxy in Apple’s services logs to be a violation of either its own policies or users’ expectations for using internet services in general. I strongly disagree that the iOS App Store should be treated as an "internet service" rather than a part of the device. The iOS App Store only comes on iOS devices, it comes on al…
>I strongly disagree that the iOS App Store should be treated as an "internet service" It’s entire purpose is to look up data and download stuff across the internet. How can it not be an internet service? How much use could it be if it was cut off from internet connectivity, what would you even do in it?
Sure, it requires internet for it to work, just as the phone itself requires cellular service so you can make a call. Calling is still part of the phone.
Of how much use is an iPhone without the App Store? You can still use the preinstalled apps, but your expectation as a consumer is that you can install new apps. This expectation is broken without the App Store.
Re: Oh, the Places Your Apple ID Will Go
#19I see a lot of very intelligent people here unable to agree upon a matter that seems, in essence, simple enough. That is in itself troubling and partly answers a question. If developers on Hacker News cannot fathom whether Apple deceptively transmitted PII, or whether zealous journalists are over-egging the pudding, then we have another problem. Obfuscation is a form of deception through complexity. It can be hard to…
Could not have expressed my thoughts more clearly.
Re: Oh, the Places Your Apple ID Will Go
#20Can someone explain why the App Store doesn't show the "Ask App Not To Track" dialog? Why do 3rd party apps have to ask for permission to track, but Apple's apps do not?
I read somewhere (sorry can't remember where but it was quite recent) that Apple has defined "tracking" as "allowing third parties to monitor you over multiple sites and apps".
My that definition, Apple, as a first party, is not tracking you (and likewise, I can monitor you over my apps but not allow anyone else access to that data)
UPDATE: It was from AppStore Connect itself, when you fill out the privacy data form.
Also here: https://support.apple.com/en-gb/HT211970 "data from the app that is linked with your data collected from other companies’ apps, websites or offline properties, and used for ads or shared with a data broker."