Google Exposes Apple Ad Tech Fail

Privacy has served as a competitive advantage for Apple in recent times.

The company’s ‘What happens on your iPhone, stays on your iPhone’ billboard in Las Vegas made headlines last year, while its web browser Safari has been aggressive in moves to block third-party cookies.

But according to a new report from Google, some of Apple’s privacy claims may have been overstated.

The report looks at Apple’s intelligent tracking prevention (ITP), the software introduced to Safari in 2017 to reduce cross-site tracking of web users.

And while ITP serves as a way to increase privacy for web users, Google found scenarios where savvy online advertisers could potentially bypass Apple’s safeguards.

“The ITP list can additionally be used as a fingerprint of the user. Unrelated sites read use the
contents of the ITP list to establish that their visitor is the same person who visited another website,
even without an explicit relationship between the sites,” Google says in the paper.

“This information can also be obtained by limited contexts such as sandbox iframes; it could be used – for example – by an advertiser who wants to establish a link between their ad impression and a user’s later visit to the advertiser’s site.”

Safari creates customised ITP lists based on each user’s individual browsing, something Google says “can be modified and detected by every document”.

“Any site can issue cross-site requests, increasing the number of ITP strikes for an arbitrary domain and forcing it to be added to the user’s ITP list,” argues the report.

“By checking for the side effects of ITP triggering for a given cross-site HTTP request, a website can determine whether its domain is present on the user’s ITP list; it can repeat this process and reveal ITP state for any domain.”

Apple has since confirmed it has patched the issues raised in the report.

The findings come at an interesting time for both companies.

Google recently announced it would be phasing out third-party cookies on Chrome and moving towards a ‘Privacy Sandbox’ model.

In the announcement, Google’s director of Chrome engineering Justin Schuh suggested Apple’s hardline ban on the third-party cookies may have created “unwanted consequences” for other ad tech players.

Advertise with us

Please login with linkedin to comment

Apple Google