A unique device identifier that Apple assigns to each iPhone for third parties to track users for ad targeting \u2014 aka the IDFA (Identifier for Advertisers) \u2014 is itself now the target of two new complaints filed by European privacy campaign not-for-profit, noyb.
\nThe complaints, lodged with German and Spanish data protection authorities, contend that Apple\u2019s setting of the IDFA breaches regional privacy laws on digital tracking because iOS users are not asked for their consent for the initial storage of the identifier.
\nNoyb is also objecting to others\u2019 being able to access the IDFA without prior consent \u2014 with one of its complainants writing that they were never asked for consent for third-party access yet found several apps had shared their IDFA with Facebook (per their off-Facebook activity page).<\/p>\n
We\u2019ve reached out to the data protection agencies in question for comment.\u00a0Update:\u00a0Spain\u2019s AEPD confirmed it has received noyb\u2019s complaint and said it will investigate \u2014 making no further comment at this stage.
\nWhile Apple isn\u2019t the typical target for digital privacy campaigners, given it makes most of its money selling hardware and software instead of profiling users for ad targeting, as adtech giants like Facebook and Google do, its marketing rhetoric around taking special care over user privacy can look awkward when set against the existence of an Identifier for Advertisers baked into its hardware.
\nIn the European Union there\u2019s a specific legal dimension to this awkwardness \u2014 as existing laws require explicit consent from users to (non-essential) tracking. Noyb\u2019s complaints cite Article 5(3) of the EU\u2019s ePrivacy Directive, which mandates that users must be asked for consent to the storage of ad-tracking technologies such as cookies. (And noyb argues the IDFA is just like a tracking cookie but for iPhones.)
\nEurope\u2019s top court\u00a0further strengthened the requirement last year when it made it clear that consent for non-essential tracking must be obtained prior to storing or accessing the trackers. The CJEU also ruled that such consent cannot be implied or assumed \u2014 such as by the use of pre-checked \u201cconsent\u201d boxes.<\/p>\n
Europe\u2019s top court says active consent is needed for tracking cookies<\/p>\n
In a press release about the complaints, noyb\u2019s Stefano Rossetti, a privacy lawyer, writes: \u201cEU law protects our devices from external tracking. Tracking is only allowed if users explicitly consent to it. This very simple rule applies regardless of the tracking technology used. While Apple introduced functions in their browser to block cookies, it places similar codes in its phones, without any consent by the user. This is a clear breach of EU privacy laws.\u201d
\nApple has long controlled how third parties serving apps on its iOS platform can use the IDFA, wielding the stick of ejection from its App Store to drive their compliance with its rules.
\nRecently, though, it has gone further \u2014 telling advertisers this summer they will soon have to offer users an opt-out from ad tracking in a move billed as increasing privacy controls for iOS users \u2014 although Apple delayed implementation of the policy until early next year after facing anger from advertisers over the plan. But the idea is there will be a toggle in iOS 14 that users need to flip on before a third-party app gets to access the IDFA to track iPhone users\u2019 in-app activity for ad targeting.
\nHowever, noyb\u2019s complaint focuses on Apple\u2019s setting of the IDFA in the first place \u2014 arguing that since the pseudonymised identifier constitutes private (personal) data under EU law they need to get permission before creating and storing it on their device.
\n\u201cThe IDFA is like a \u2018digital license plate\u2019. Every action of the user can be linked to the \u2018license plate\u2019 and used to build a rich profile about the user. Such profile can later be used to target personalised advertisements, in-app purchases, promotions etc. When compared to traditional internet tracking IDs, the IDFA is simply a \u2018tracking ID in a mobile phone\u2019 instead of a tracking ID in a browser cookie,\u201d noyb writes in one complaint, noting that Apple\u2019s privacy policy does not specify the legal basis it uses to \u201cplace and process\u201d the IDFA.
\nNoyb also argues that Apple\u2019s planned changes to how the IDFA gets accessed \u2014 trailed as incoming in early 2021 \u2014 don\u2019t go far enough.
\n\u201cThese changes seem to restrict the use of the IDFA for third parties (but not for Apple itself),\u201d it writes. \u201cJust like when an app requests access to the camera or microphone, the plans foresee a new dialog that asks the user if an app should be able to access the IDFA. However, the initial storage of the IDFA and Apple\u2019s use of it will still be done without the users\u2019 consent and therefore in breach of EU law. It is unclear when and if these changes will be implemented by the company.\u201d
\nWe reached out to Apple for comment on noyb\u2019s complaints but at the time of writing an Apple spokesman said it did not have an on-the-record statement. The spokesman did tell us that Apple itself does not use unique customer identifiers for advertising. Update: The company has now sent us this statement:
\nThe claims made against Apple in this complaint are factually inaccurate and we look forward to making that clear to privacy regulators should they examine the complaint. Apple does not access or use the IDFA on a user\u2019s device for any purpose. Our aim is always to protect the privacy of our users and our latest software release, iOS 14, is giving users even greater control over whether or not they want to allow apps to track them by linking their information with data from third parties for the purpose of advertising, or sharing their information with data brokers. Our practices comply with European law and support and advance the aims of the GDPR and the ePrivacy Directive, which is to give people full control over their data.
\nIn a separate but related recent development, last month publishers and advertisers in France filed an antitrust complaint against the iPhone maker over its plan to require opt-in consent for accessing the IDFA \u2014 with the coalition contending the move amounts to an abuse of market power.
\nApple responded to the antitrust complaint in a statement that said: \u201cWith iOS 14, we\u2019re giving users the choice whether or not they want to allow apps to track them by linking their information with data from third parties for the purpose of advertising, or sharing their information with data brokers.\u201d
\n\u201cWe believe privacy is a fundamental human right and support the European Union\u2019s leadership in protecting privacy with strong laws such as the GDPR (General Data Protection Regulation),\u201d Apple added then.
\nThat antitrust complaint may explain why noyb has decided to file its own strategic complaints against Apple\u2019s IDFA. Simply put, if no tracker ID can be created \u2014 because an iOS user refuses to give consent \u2014 there\u2019s less surface area for advertisers to try to litigate against privacy by claiming tracking is a competitive right.
\n\u201cWe believe that Apple violated the law before, now and after these changes,\u201d said Rossetti in another statement. \u201cWith our complaints we want to enforce a simple principle: trackers are illegal, unless a user freely consents. The IDFA should not only be restricted, but permanently deleted. Smartphones are the most intimate device for most people and they must be tracker-free by default.\u201d
\nAnother interesting component of the noyb complaints is they\u2019re being filed under the ePrivacy Directive, rather than under Europe\u2019s (newer) General Data Protection Regulation. This means noyb is able to target them to specific EU data protection agencies, rather than having complaints funnelled back to Ireland\u2019s DPC \u2014 under the GDPR\u2019s one-stop-shop mechanism for handling cross-border cases.
\nIts hope is this route will result in swifter regulatory action. \u201cThese cases are based on the \u2018old\u2019 cookie law and do not trigger the cooperation mechanism of the GDPR. In other words, we are trying to avoid endless procedures like the ones we are facing in Ireland,\u201d added Rossetti.<\/p>\n
Lack of big tech GDPR decisions looms large in EU watchdog\u2019s annual report<\/p>\n