Title doesn't match the article, which is currently "Apple changes its rules for personalised advertising in apps".
Apple gave itself better dialogs for the permission prompts, which they will now equalize (perhaps just in the EU?) with the prompts they use for their own apps.
My understanding of ATTF is that first-party tracking needed no disclosure other than the information declared in the app's App Store privacy section about the information gathered. If you made a suite of 20 apps, you could track usage across all of them without issue, as long as you didn't also share that info with a third party.
Apple didn't give itself better dialogs. It never did third-party tracking across across apps or websites so the ATT prompt would never apply to their apps. It also voluntarily showed a dialog explicitly asking you to opt into personalized advertising. Facebook doesn't show anything similar when you use Instagram or the Facebook app, because that would be undoubtedly bad for business.
The German regulator settled because the facts are simply on Apple's side. Apple settled because at the end of the day it's no skin off their back if the EU now wants to weaken privacy protections to benefit ad-tech.
>Apple only gives third-party app publishers access to the IDFA if they have obtained user consent through a dedicated consent prompt that is largely predefined by Apple – the so-called ATT prompt. If the user refuses to give consent in this prompt, the app publisher does not gain access to the IDFA.
According to the Bundeskartellamt’s investigation, there are no other technical options available to app publishers that are equally suitable for exchanging data across companies.
In contrast, Apple’s own personalised advertising is subject to different conditions. Apple itself does not use the IDFA and cross-company data combination, but draws on user data from its own ecosystem – a wealth of data that is not available, in particular, to the large number of smaller app publishers. This is why Apple is not subject to the requirement of displaying an ATT prompt. Insofar as Apple requests consent to its own processing of user data for advertising purposes, the company uses a different consent prompt – the so-called PA prompt (“Personalized Ads prompt”). The design of the PA prompt differs from that of the ATT prompt for third-party app publishers.
Ok, let's break down your claims one by one and compare to the text of the FAQ...
> Apple didn't give itself better dialogs.
On the contrary page two of the FAQ states "The design of the PA prompt
differs from that of the ATT prompt for third-party app publishers."
> It never did third-party tracking across across apps or websites
The FAQ strongly implies that they did track across apps and websites, i.e. "draws on user data from its own ecosystem [which involves multiple apps and websites]",
> It also voluntarily showed a dialog explicitly asking you to opt into personalized advertising.
Nothing in the FAQ supports that this was voluntarily and not required by law. In fact it strongly implies the opposite "the General Data Protection Regulation (GDPR) and the provisions of the ePrivacy Directive, in particular, require app publishers to obtain user consent for certain types of data processing" ... "Insofar as Apple requests consent to its own processing of user data for advertising purposes,"
> Facebook doesn't show anything similar when you use Instagram or the Facebook app, because that would be undoubtedly bad for business.
Nothing in the FAQ supports this claim, and as discussed in other comments here it is simply false.
> The German regulator settled because the facts are simply on Apple's side. Apple settled because at the end of the day it's no skin off their back if the EU now wants to weaken privacy protections to benefit ad-tech.
>On the contrary page two of the FAQ states "The design of the PA prompt differs from that of the ATT prompt for third-party app publishers."
The PA prompt is a voluntary (required in the EU?) prompt Apple shows requesting opt-in for personalzied ads. It is of course different from ATT because it doesn't involve third-parties whatsoever.
If Apple wanted, it could mirror Facebook's behavior (in the rest of the world) by not showing any PA prompt. This would greatly increase the number of people who are exposed to personalized ads from Apple's first-party ad network.
>The FAQ strongly implies that they did track across apps and websites, i.e. "draws on user data from its own ecosystem [which involves multiple apps and websites]",
It draws on data from Apple's first-party apps.
>Nothing in the FAQ supports that this was voluntarily and not required by law. In fact it strongly implies the opposite "the General Data Protection Regulation (GDPR) and the provisions of the ePrivacy Directive, in particular, require app publishers to obtain user consent for certain types of data processing" ... "Insofar as Apple requests consent to its own processing of user data for advertising purposes,"
My comment refers to Apple and app developer behavior in the rest of the world.
>Noting in the FAQ supports any of these claims.
That is my informed opinion based on following this story since the very beginning.
> It is of course different from ATT because it doesn't involve third-parties whatsoever. [and] It draws on data from Apple's first-party apps. [and] It draws on data from Apple's first-party apps.
Your original comment does not distinguish between multiple first and multiple third party apps. This is defending a comment you did not write. Regardless the FAQ you cite does not say whether or not Apple is collecting or aggregating with data from third party apps (just that it is not using the apple specific identifier for advertisers to do so) nor say that not doing so is why the PA prompt is different. And again it does not support your assertion that it is voluntary (in or out of the EU). So again your claim that page 1 of the faq supports all of your original comment is wrong - it supports literally none of it.
> My comment refers to Apple and app developer behavior in the rest of the world.
No, your comment explicitly refers to the behavior of Apple in its interactions with the german regulator, which is its behavior on germany, not the rest of the world.
>Your original comment does not distinguish between multiple first and multiple third party apps. This is defending a comment you did not write. Regardless the FAQ you cite does not say whether or not Apple is collecting or aggregating with data from third party apps nor say that is why the PA prompt is different. And again it does not support your assertion that it is voluntary (in or out of the EU). So again your claim that page 1 of the faq supports all of your original comment is wrong - it supports literally none of it.
That is what Apple says about their ad network and what they've said in communications with regulators. And if they were actually doing third-party tracking, that would actually be an instance of Apple being a hypocrite. The regulator would have had them dead to rights if that were the case. The regulator doesn't actually say Apple was doing that.
The quoted section from page 1 indeed says that Apple does not use the IDFA nor uses cross-company combination of data:
>Apple itself does not use the IDFA and cross-company data combination, but draws on user data from its own ecosystem – a wealth of data that is not available, in particular, to the large number of smaller app publishers. This is why Apple is not subject to the requirement of displaying an ATT prompt.
>No, your comment explicitly refers to the behavior of Apple in its interactions with the german regulator, which is its behavior on germany, not the rest of the world.
I wrote my comment and know what I was referring to and I clarified it in later comments. I'm sorry you misunderstood.
Your mistaken, words have meanings, I understood perfectly, I'm sorry you did not write the comment you meant to but intending to write something other than what you did does not mean you did so.
I see the regulators only regulated that first-party and third-party apps be treated equally, and didn’t specify how.
It’s a bummer (albeit an expected one) to see Apple reducing the burden for third-party publishers to collect personal data, rather than increasing the burden for themselves to collect it, thus overall raising the floor of user privacy. This is to say, when a regulator requests “everyone be treated equally to ensure competition” maybe they should also take into account how users are impacted and instead request something more nuanced like: if there are unequal standards, they must be equalized in a way that maximizes user benefit.
Apple's hypocrisy is a longstanding issue with regard to their apps vs 3rd party apps. As I recall when the Green Bubbles first happened in messages someone pointed out that Apples own design guidelines specified a minimum contrast in colors or they would reject apps, and the green bubbles with white text did not meet that threshold at the time, and it stayed that way for quite a while. And for all I know the light themed version of the app still does (I have mine on permanent dark theme).
In Japan (not sure in other countries), I went to the Apple Store. They said to complete the purchase, use the Apple Store app and scan this QR code on their device. I did and it immediately wanted me to share a ton of info with the main highlighed button "Share Now" and in small lettering below that "customize and share", where in you can see all the stuff they were going to take.
1. The competition law people are not the data protection people. From the perspective of competition law, they only care that the playing field is leveled, they don't care if you equalize down or up.
2. The EU has fumbled the ball on GDPR by not enforcing it on the tech giants that it was intended to regulate[0], to the point where a tech company enforcing the intent of the law and not the letter of the law feels like singling out competitors.
[0] In particular, the Republic of Ireland is a rotten borough for Facebook, who has all their EU offices there.
Baloney I don’t see anything in these laws that actually stops the onward march of companies effing the customers. All I see is the move to have give equal access to effing the customer even more.
They are doing nothing to stop the endless ads, and the pop-ups in the browser I want to kill turn them off not them grant equal access to have even more ads.
Another problem is the onward, march towards renting leasing, owning nothing endless upgrades for price, in the end I don’t expect a bunch of lawyers and bureaucrats to do anything about that. They have been paid off long time ago.
Recently in the last couple of years in particular it’s gotten to be completely out of control. I’m glad I bought a super drive before Apple discontinued it soon the way things are going you won’t even be able to have a large drive or even big memory you’ll be tied to that remote data center…
For me it depends on which app and which permissions, like "Photos" obviously needs to be able to see my photos... Camera needs my camera, but for location it should ask me before it turns it on.
I don't even care if they make the dialogue look a little different since they're system apps you need to use the features of your phone, but the "extras" they support should default to "Ask First" in an ideal world that is.
The Photos app does not need permission any more than any other Photos app. It can ask "Photos app wants to access your photos" and you can click "Always", "Selected Photos", "No" and download some other app to access your photos. That would be the "equal" thing to do. Let the user pick what app they want to access their photos with.
Same with the Camera App. It can ask "Camera App wants to access your Camera" and you can say "No" and then download some other camera app and make that your default and grant it camera permission.
In addition to that, there are permissions that Apple gives to its own apps that it denies to competitors even if the user consents to it, e.g. permission to install third party apps is given to Apple's store app without asking but can't be given to the Steam app even if the user wants that.
Fair, but when a 3p app has camera in the name and app description then why does it need to ask permission to use the camera?
*just to be clear I think that the stock camera app not asking for camera permission is fine but skipping permission about location tracking is wrong. Having the same standard should be applied to both 1p and 3p apps feel like a fair way to ensure that good practices are used in 1p apps and good policies are use in the 3p ecosystem
As a personal example, Google Meet while not having “camera” in the name has an icon with a camera, a description that talks about “video calling” and is intentionally designed to support and enable video calls. And on my device I have declined to give meet permission to access the camera. On the rare occasions I need to use the app on my phone, I’m probably somewhere where I can’t or don’t want to be using the camera. It is simply safer and easier to deny the application access to the camera than it is to rely on its own internal functionality to disable using the camera. And it’s safer and simpler to require all 3rd party apps that want access to the camera to explicitly ask for permission than it is to evaluate them all for whether or not their use of the camera is both necessary and obvious enough that they don’t need the permission.
I remember somebody trying to hook into the Apple Find My network (that is, do things with AirTags). They did that by… being a Mail.app plug-in or something to get the correct entitlements? That certainly sounds like the wrong permissions.
Oh, wow, haven't heard of Apple Mail plugins in a decade! I really thought Apple would have deprecated them by now.
Mail plugins are kind of a special case, they're REALLY "legacy", so they work by sharing process memory and being able to access way more than they should, like all your messages, possibly even passwords if the developer is clever enough.
Also notoriously difficult to build, since the Mail internal API breaks from time to time, so they're a rarity these days.
But what does the "Access to photos" permission really do here? It's not like not having that permission would stop Apple from accessing them against your will, as they have access via the OS anyway. And it's clear, that when you open the Apple Photos app, that it will access your photos.
On the other hand, when you open a third party app, it may not have been clear to you that it wants to access your photos, and the company did not have prior access to them.
I still think apps should only be pre-blessed sparingly. For example, the camera app should not have GPS permission by default, as many people probably aren't aware that camera apps use that information.
> It's not like not having that permission would stop Apple from accessing them against your will, as they have access via the OS anyway.
This presumes the OS is something other than a bundle of apps.
Does the filesystem driver have access to your photos stored in the filesystem? Naturally. As would a third party filesystem driver, e.g. if you wanted an app to let you plug a USB drive into your iPad and use NTFS or ext4 filesystems or use various network filesystems.
And then the obvious question is why Apple should be able to give iCloud or its filesystem software access to things the user can't give Dropbox or some open source NFS app permission to do. Or why the user can't deny that permission to the Apple code, or remove it, when they want to use a competitor instead.
"Access to Photos" is a complicated one: Lots of apps only needs this permission when building a custom photo selector. Like Facebook/WhatsApp/Instagram do, also Slack.
For every other app, they can use the system's default photo picker and it works without permission.
For example, the "Lunch Receipt Scanner" that my company uses: I'm happy to allow it on my phone, as it saves a lot of time, but I wouldn't want a company app having access to my entire camera roll!!!
I personally also don't like that WhatsApp/Instagram/Facebook/Slack asks for access to the whole album just to display the photo picker, but I'm pretty sure some designer or product manager made a strong case for it internally. (EDIT: Not saying having a case justifies it, I'm more lamenting the situation)
> I personally also don't like that WhatsApp/Instagram/Facebook/Slack asks for access to the whole album just to display the photo picker, but I'm pretty sure some designer or product manager made a strong case for it internally.
Main reason I don't use the in-app photo pickers for these but "share" the photo I want to upload from Photos into the app. Zero trust for these companies.
That should be supported, but if its the only "Photo Gallery" app installed, I think its okay. Curious, do you use another one that's better? I have looked (though not very invested in looking) and didn't really see anything that caught my eye.
I can certainly imagine one that's better. One that catelogs all the images using better AI that apples and lets me do complex searches "Dog at beach", "Joey in red shirt with Jane"
>Apple's own apps are still blessed with permissions that other apps have to ask for. This needs to be addressed too.
This is a strange position imo. Why would we expect third party apps written by totally unknown people with unknown goals to have the same permissions as apps written by Apple itself?
I don't think that is contradictory either. By limiting 3rd-party permissions, Apple is able to prevent many potential issues before an application even makes it to the vetting process. The less there is to vet, the more robust the vetting process should be in theory.
They also do other things you aren’t allowed to do as a developer - eg. When they do a ‘free trial’ of Apple TV, if you cancel it cancels immediately. All proper subscriptions you retain the use of until the renewal date.
Imagining my grandpa calling me because his camera doesn't work because he denied the camera permission on his camera app. But then he can't because he denied all the permissions his phone app needs.
What argument? Are you preemptively mad about something that's not happening? I just had a funny thought brother, I'd rather not be involved in your OS platform supremacy battle.
He who creates the operating system creates the terms for that system I don’t expect to use an OpenAI program and then tell them what to do at every turn in comparison to Anthropic or any of the other AI model makers. (whoops I forgot the lawyers work for other business interests they don’t want to do anything about rent letting not really their solution always framed in a way where they claim to be looking out for the public interest). when in reality, they are just looking out for other business interest.
In the case of operating systems, I simply select a different operating system, and the same principle applies to AI models. It is amusing that Microsoft and Linux are available to consumers, providing them with a choice. However, simply because the decisions made by one or the other are superior/better does not imply that everyone should be reduced to a similar low level.
Apple is not even close to being the dominant operating system or hardware platform, globally, yet you still expect them to be mediocre, akin to most of their competition.
Meta would have a field day with this change, since it was the company that was most upset and angry when ATT was introduced.
Considering that ATT was about sharing an identifier to “track across other companies' apps and websites” (text definition of the ATT setting), I don’t believe this ruling is a good move for anyone on informed consent or privacy. In the name of improving competition, sometimes regulators may end up making things worse for users.
Meta, the same company that used to play silent audio so it wouldn't be killed in the background? I'm not super worried about them being upset about privacy laws changing.
> In addition, app publishers and content providers, such as media publishers, will be given more scope to explain to users what significance personalised advertising has for their offering and their business model.
Great, sounds like a new channel for marketing where I really just want to opt-out. Also, does this added scope include the mechanism to maliciously comply like so many websites do with cookies? (eg: You want our cookies? Here is a list of things you can de-select... with toggles that aren't clearly on or off)
> With its operating systems and its App Store, Apple controls a key infrastructure for the distribution of apps on its devices. In addition, Apple offers its own apps and advertising space. This dual role makes Apple subject to specific competition law requirements.
> Under the commitments that have now been declared binding, Apple will align the consent prompts for its own offerings and for third-party apps much more closely.
I used to work on an app with one of the largest repos of health data in the App Store. Their team specifically leaned on us to have more favorable text when the data sharing requests came through. Felt very inappropriate given we were often at Apple’s mercy. Seems like a consistent cultural issue.
Maybe build your own operating system? But we are very lucky there are two other superior choices out there, and they have even bigger market-share, Microsoft Windows and Linux.
I keep hearing from people that they’re awesome to use so why do people care about the smallest system available worldwide? Why does anyone care what Apple does or anyone else if they decide to make their own operating system?
iOS is a dominant OS with billions of users. In the US it has the majority market share of the smartphone market.
So whether Apple likes it or not, now their OS is a platform and has different responsibilities compared to your hobby OS that you developed to play with, and accidentally you got 10 users.
As has been evident in many spheres of human activity recently, being brazen about conflicts of interest, is often used as a PR shield for those conflicts.
Sometimes transparency and honesty get weaponized. Especially by actors with centralized power.
(Not arguing against transparency, but against misinterpreting it as always being used in good faith.)
You want to handle device rotation smoothly in your in-app browser?
Tough luck, WebKit's _beginAnimatedResizeWithUpdates is private, and only Apple gets to use it in Safari.
Good luck with the animation and scroll position handling. You better hope WkWebView's default behavior works for you, because you don't get to customize it and fix edge cases or the tab previews, like Apple did for their browser.
Title doesn't match the article, which is currently "Apple changes its rules for personalised advertising in apps".
Apple gave itself better dialogs for the permission prompts, which they will now equalize (perhaps just in the EU?) with the prompts they use for their own apps.
My understanding of ATTF is that first-party tracking needed no disclosure other than the information declared in the app's App Store privacy section about the information gathered. If you made a suite of 20 apps, you could track usage across all of them without issue, as long as you didn't also share that info with a third party.
Apple didn't give itself better dialogs. It never did third-party tracking across across apps or websites so the ATT prompt would never apply to their apps. It also voluntarily showed a dialog explicitly asking you to opt into personalized advertising. Facebook doesn't show anything similar when you use Instagram or the Facebook app, because that would be undoubtedly bad for business.
The German regulator settled because the facts are simply on Apple's side. Apple settled because at the end of the day it's no skin off their back if the EU now wants to weaken privacy protections to benefit ad-tech.
EDIT: You can downvote me all you like, but it's right there on page 1 of the FAQ from the regulator. https://www.bundeskartellamt.de/SharedDocs/Publikation/EN/Pr...
Instagram does, in fact, have such a dialog in the EU. Because they are legally required to, like everybody else.
I don't live in the EU. My comment is based on what they do in the rest of the world.
What "The German regulator" did is definitely not based on what they do in the rest of the world.
What Apple and Facebook do in their apps in the rest of the world.
Based on the final paragraph before the edit it sounds like it was about Germany and the EU as a whole
Nothing on page 1 of the faq supports any of the assertions in your comment.
>Apple only gives third-party app publishers access to the IDFA if they have obtained user consent through a dedicated consent prompt that is largely predefined by Apple – the so-called ATT prompt. If the user refuses to give consent in this prompt, the app publisher does not gain access to the IDFA. According to the Bundeskartellamt’s investigation, there are no other technical options available to app publishers that are equally suitable for exchanging data across companies.
In contrast, Apple’s own personalised advertising is subject to different conditions. Apple itself does not use the IDFA and cross-company data combination, but draws on user data from its own ecosystem – a wealth of data that is not available, in particular, to the large number of smaller app publishers. This is why Apple is not subject to the requirement of displaying an ATT prompt. Insofar as Apple requests consent to its own processing of user data for advertising purposes, the company uses a different consent prompt – the so-called PA prompt (“Personalized Ads prompt”). The design of the PA prompt differs from that of the ATT prompt for third-party app publishers.
Ok, let's break down your claims one by one and compare to the text of the FAQ...
> Apple didn't give itself better dialogs.
On the contrary page two of the FAQ states "The design of the PA prompt differs from that of the ATT prompt for third-party app publishers."
> It never did third-party tracking across across apps or websites
The FAQ strongly implies that they did track across apps and websites, i.e. "draws on user data from its own ecosystem [which involves multiple apps and websites]",
> It also voluntarily showed a dialog explicitly asking you to opt into personalized advertising.
Nothing in the FAQ supports that this was voluntarily and not required by law. In fact it strongly implies the opposite "the General Data Protection Regulation (GDPR) and the provisions of the ePrivacy Directive, in particular, require app publishers to obtain user consent for certain types of data processing" ... "Insofar as Apple requests consent to its own processing of user data for advertising purposes,"
> Facebook doesn't show anything similar when you use Instagram or the Facebook app, because that would be undoubtedly bad for business.
Nothing in the FAQ supports this claim, and as discussed in other comments here it is simply false.
> The German regulator settled because the facts are simply on Apple's side. Apple settled because at the end of the day it's no skin off their back if the EU now wants to weaken privacy protections to benefit ad-tech.
Noting in the FAQ supports any of these claims.
>On the contrary page two of the FAQ states "The design of the PA prompt differs from that of the ATT prompt for third-party app publishers."
The PA prompt is a voluntary (required in the EU?) prompt Apple shows requesting opt-in for personalzied ads. It is of course different from ATT because it doesn't involve third-parties whatsoever.
If Apple wanted, it could mirror Facebook's behavior (in the rest of the world) by not showing any PA prompt. This would greatly increase the number of people who are exposed to personalized ads from Apple's first-party ad network.
>The FAQ strongly implies that they did track across apps and websites, i.e. "draws on user data from its own ecosystem [which involves multiple apps and websites]",
It draws on data from Apple's first-party apps.
>Nothing in the FAQ supports that this was voluntarily and not required by law. In fact it strongly implies the opposite "the General Data Protection Regulation (GDPR) and the provisions of the ePrivacy Directive, in particular, require app publishers to obtain user consent for certain types of data processing" ... "Insofar as Apple requests consent to its own processing of user data for advertising purposes,"
My comment refers to Apple and app developer behavior in the rest of the world.
>Noting in the FAQ supports any of these claims.
That is my informed opinion based on following this story since the very beginning.
> It is of course different from ATT because it doesn't involve third-parties whatsoever. [and] It draws on data from Apple's first-party apps. [and] It draws on data from Apple's first-party apps.
Your original comment does not distinguish between multiple first and multiple third party apps. This is defending a comment you did not write. Regardless the FAQ you cite does not say whether or not Apple is collecting or aggregating with data from third party apps (just that it is not using the apple specific identifier for advertisers to do so) nor say that not doing so is why the PA prompt is different. And again it does not support your assertion that it is voluntary (in or out of the EU). So again your claim that page 1 of the faq supports all of your original comment is wrong - it supports literally none of it.
> My comment refers to Apple and app developer behavior in the rest of the world.
No, your comment explicitly refers to the behavior of Apple in its interactions with the german regulator, which is its behavior on germany, not the rest of the world.
>Your original comment does not distinguish between multiple first and multiple third party apps. This is defending a comment you did not write. Regardless the FAQ you cite does not say whether or not Apple is collecting or aggregating with data from third party apps nor say that is why the PA prompt is different. And again it does not support your assertion that it is voluntary (in or out of the EU). So again your claim that page 1 of the faq supports all of your original comment is wrong - it supports literally none of it.
That is what Apple says about their ad network and what they've said in communications with regulators. And if they were actually doing third-party tracking, that would actually be an instance of Apple being a hypocrite. The regulator would have had them dead to rights if that were the case. The regulator doesn't actually say Apple was doing that.
The quoted section from page 1 indeed says that Apple does not use the IDFA nor uses cross-company combination of data:
>Apple itself does not use the IDFA and cross-company data combination, but draws on user data from its own ecosystem – a wealth of data that is not available, in particular, to the large number of smaller app publishers. This is why Apple is not subject to the requirement of displaying an ATT prompt.
>No, your comment explicitly refers to the behavior of Apple in its interactions with the german regulator, which is its behavior on germany, not the rest of the world.
I wrote my comment and know what I was referring to and I clarified it in later comments. I'm sorry you misunderstood.
Your mistaken, words have meanings, I understood perfectly, I'm sorry you did not write the comment you meant to but intending to write something other than what you did does not mean you did so.
That's okay. Everyone else can determine who has the better argument for themselves.
I see the regulators only regulated that first-party and third-party apps be treated equally, and didn’t specify how.
It’s a bummer (albeit an expected one) to see Apple reducing the burden for third-party publishers to collect personal data, rather than increasing the burden for themselves to collect it, thus overall raising the floor of user privacy. This is to say, when a regulator requests “everyone be treated equally to ensure competition” maybe they should also take into account how users are impacted and instead request something more nuanced like: if there are unequal standards, they must be equalized in a way that maximizes user benefit.
Regulations for user privacy shouldn't be conflated with regulations for market competition.
I also delight in this highlighting Apple's hypocrisy
Apple's hypocrisy is a longstanding issue with regard to their apps vs 3rd party apps. As I recall when the Green Bubbles first happened in messages someone pointed out that Apples own design guidelines specified a minimum contrast in colors or they would reject apps, and the green bubbles with white text did not meet that threshold at the time, and it stayed that way for quite a while. And for all I know the light themed version of the app still does (I have mine on permanent dark theme).
https://medium.com/@krvoller/how-iphone-violates-apples-acce...
In Japan (not sure in other countries), I went to the Apple Store. They said to complete the purchase, use the Apple Store app and scan this QR code on their device. I did and it immediately wanted me to share a ton of info with the main highlighed button "Share Now" and in small lettering below that "customize and share", where in you can see all the stuff they were going to take.
Apple, That's Privacy
https://www.youtube.com/watch?v=kb9vJq4gQOw
There's two problems here:
1. The competition law people are not the data protection people. From the perspective of competition law, they only care that the playing field is leveled, they don't care if you equalize down or up.
2. The EU has fumbled the ball on GDPR by not enforcing it on the tech giants that it was intended to regulate[0], to the point where a tech company enforcing the intent of the law and not the letter of the law feels like singling out competitors.
[0] In particular, the Republic of Ireland is a rotten borough for Facebook, who has all their EU offices there.
A good step.
Apple's own apps are still blessed with permissions that other apps have to ask for. This needs to be addressed too.
Baloney I don’t see anything in these laws that actually stops the onward march of companies effing the customers. All I see is the move to have give equal access to effing the customer even more.
They are doing nothing to stop the endless ads, and the pop-ups in the browser I want to kill turn them off not them grant equal access to have even more ads.
Another problem is the onward, march towards renting leasing, owning nothing endless upgrades for price, in the end I don’t expect a bunch of lawyers and bureaucrats to do anything about that. They have been paid off long time ago.
Recently in the last couple of years in particular it’s gotten to be completely out of control. I’m glad I bought a super drive before Apple discontinued it soon the way things are going you won’t even be able to have a large drive or even big memory you’ll be tied to that remote data center…
For me it depends on which app and which permissions, like "Photos" obviously needs to be able to see my photos... Camera needs my camera, but for location it should ask me before it turns it on.
I don't even care if they make the dialogue look a little different since they're system apps you need to use the features of your phone, but the "extras" they support should default to "Ask First" in an ideal world that is.
The Photos app does not need permission any more than any other Photos app. It can ask "Photos app wants to access your photos" and you can click "Always", "Selected Photos", "No" and download some other app to access your photos. That would be the "equal" thing to do. Let the user pick what app they want to access their photos with.
Same with the Camera App. It can ask "Camera App wants to access your Camera" and you can say "No" and then download some other camera app and make that your default and grant it camera permission.
In addition to that, there are permissions that Apple gives to its own apps that it denies to competitors even if the user consents to it, e.g. permission to install third party apps is given to Apple's store app without asking but can't be given to the Steam app even if the user wants that.
Fair, but when a 3p app has camera in the name and app description then why does it need to ask permission to use the camera? *just to be clear I think that the stock camera app not asking for camera permission is fine but skipping permission about location tracking is wrong. Having the same standard should be applied to both 1p and 3p apps feel like a fair way to ensure that good practices are used in 1p apps and good policies are use in the 3p ecosystem
As a personal example, Google Meet while not having “camera” in the name has an icon with a camera, a description that talks about “video calling” and is intentionally designed to support and enable video calls. And on my device I have declined to give meet permission to access the camera. On the rare occasions I need to use the app on my phone, I’m probably somewhere where I can’t or don’t want to be using the camera. It is simply safer and easier to deny the application access to the camera than it is to rely on its own internal functionality to disable using the camera. And it’s safer and simpler to require all 3rd party apps that want access to the camera to explicitly ask for permission than it is to evaluate them all for whether or not their use of the camera is both necessary and obvious enough that they don’t need the permission.
I remember somebody trying to hook into the Apple Find My network (that is, do things with AirTags). They did that by… being a Mail.app plug-in or something to get the correct entitlements? That certainly sounds like the wrong permissions.
Ah, it was OpenHaystack: https://github.com/seemoo-lab/openhaystack#installation
Oh, wow, haven't heard of Apple Mail plugins in a decade! I really thought Apple would have deprecated them by now.
Mail plugins are kind of a special case, they're REALLY "legacy", so they work by sharing process memory and being able to access way more than they should, like all your messages, possibly even passwords if the developer is clever enough.
Also notoriously difficult to build, since the Mail internal API breaks from time to time, so they're a rarity these days.
Also notoriously difficult to install.
> like "Photos" obviously needs to be able to see my photos...
Maybe you'd like to use a competitor to the Photos app and don't want to use the one Apple provides?
Maybe.
But what does the "Access to photos" permission really do here? It's not like not having that permission would stop Apple from accessing them against your will, as they have access via the OS anyway. And it's clear, that when you open the Apple Photos app, that it will access your photos.
On the other hand, when you open a third party app, it may not have been clear to you that it wants to access your photos, and the company did not have prior access to them.
I still think apps should only be pre-blessed sparingly. For example, the camera app should not have GPS permission by default, as many people probably aren't aware that camera apps use that information.
> It's not like not having that permission would stop Apple from accessing them against your will, as they have access via the OS anyway.
This presumes the OS is something other than a bundle of apps.
Does the filesystem driver have access to your photos stored in the filesystem? Naturally. As would a third party filesystem driver, e.g. if you wanted an app to let you plug a USB drive into your iPad and use NTFS or ext4 filesystems or use various network filesystems.
And then the obvious question is why Apple should be able to give iCloud or its filesystem software access to things the user can't give Dropbox or some open source NFS app permission to do. Or why the user can't deny that permission to the Apple code, or remove it, when they want to use a competitor instead.
Tangential but:
"Access to Photos" is a complicated one: Lots of apps only needs this permission when building a custom photo selector. Like Facebook/WhatsApp/Instagram do, also Slack.
For every other app, they can use the system's default photo picker and it works without permission.
For example, the "Lunch Receipt Scanner" that my company uses: I'm happy to allow it on my phone, as it saves a lot of time, but I wouldn't want a company app having access to my entire camera roll!!!
I personally also don't like that WhatsApp/Instagram/Facebook/Slack asks for access to the whole album just to display the photo picker, but I'm pretty sure some designer or product manager made a strong case for it internally. (EDIT: Not saying having a case justifies it, I'm more lamenting the situation)
And those product designers who violate privacy that badly should be personally liable imo.
I agree 100%.
> I personally also don't like that WhatsApp/Instagram/Facebook/Slack asks for access to the whole album just to display the photo picker, but I'm pretty sure some designer or product manager made a strong case for it internally.
Main reason I don't use the in-app photo pickers for these but "share" the photo I want to upload from Photos into the app. Zero trust for these companies.
Yep I do the same. Also zero trust from my side.
That should be supported, but if its the only "Photo Gallery" app installed, I think its okay. Curious, do you use another one that's better? I have looked (though not very invested in looking) and didn't really see anything that caught my eye.
I can certainly imagine one that's better. One that catelogs all the images using better AI that apples and lets me do complex searches "Dog at beach", "Joey in red shirt with Jane"
Well you could argue all bundled OS apps should have a dialog similar to the browser selection Microsoft was forced to implement.
The nasty bit about location services is that it is trivially easy to turn it on but much harder to turn it off.
>Apple's own apps are still blessed with permissions that other apps have to ask for. This needs to be addressed too.
This is a strange position imo. Why would we expect third party apps written by totally unknown people with unknown goals to have the same permissions as apps written by Apple itself?
I thought the appstore was safe because of its vetting, at least that's what they officially say
I don't think that is contradictory either. By limiting 3rd-party permissions, Apple is able to prevent many potential issues before an application even makes it to the vetting process. The less there is to vet, the more robust the vetting process should be in theory.
They also do other things you aren’t allowed to do as a developer - eg. When they do a ‘free trial’ of Apple TV, if you cancel it cancels immediately. All proper subscriptions you retain the use of until the renewal date.
Imagining my grandpa calling me because his camera doesn't work because he denied the camera permission on his camera app. But then he can't because he denied all the permissions his phone app needs.
This is about tracking not actual functionality .
Yeah I messed up, was supposed to reply to https://news.ycombinator.com/item?id=49331222#49331921
> ... Apple's own apps are still blessed with permissions that other apps have to ask for. This needs to be addressed too.
Had a laugh :D
Things that don't happen and that you make up for to win a hypothetical argument: this one.
What argument? Are you preemptively mad about something that's not happening? I just had a funny thought brother, I'd rather not be involved in your OS platform supremacy battle.
He who creates the operating system creates the terms for that system I don’t expect to use an OpenAI program and then tell them what to do at every turn in comparison to Anthropic or any of the other AI model makers. (whoops I forgot the lawyers work for other business interests they don’t want to do anything about rent letting not really their solution always framed in a way where they claim to be looking out for the public interest). when in reality, they are just looking out for other business interest.
In the case of operating systems, I simply select a different operating system, and the same principle applies to AI models. It is amusing that Microsoft and Linux are available to consumers, providing them with a choice. However, simply because the decisions made by one or the other are superior/better does not imply that everyone should be reduced to a similar low level.
Apple is not even close to being the dominant operating system or hardware platform, globally, yet you still expect them to be mediocre, akin to most of their competition.
Meta would have a field day with this change, since it was the company that was most upset and angry when ATT was introduced.
Considering that ATT was about sharing an identifier to “track across other companies' apps and websites” (text definition of the ATT setting), I don’t believe this ruling is a good move for anyone on informed consent or privacy. In the name of improving competition, sometimes regulators may end up making things worse for users.
Meta, the same company that used to play silent audio so it wouldn't be killed in the background? I'm not super worried about them being upset about privacy laws changing.
Could you provide a reference about them playing silent audio? I was curious and searched for it but wasn't able to find anything.
> In addition, app publishers and content providers, such as media publishers, will be given more scope to explain to users what significance personalised advertising has for their offering and their business model.
Great, sounds like a new channel for marketing where I really just want to opt-out. Also, does this added scope include the mechanism to maliciously comply like so many websites do with cookies? (eg: You want our cookies? Here is a list of things you can de-select... with toggles that aren't clearly on or off)
> With its operating systems and its App Store, Apple controls a key infrastructure for the distribution of apps on its devices. In addition, Apple offers its own apps and advertising space. This dual role makes Apple subject to specific competition law requirements.
> Under the commitments that have now been declared binding, Apple will align the consent prompts for its own offerings and for third-party apps much more closely.
Fork found in kitchen.
spoon still missing
I used to work on an app with one of the largest repos of health data in the App Store. Their team specifically leaned on us to have more favorable text when the data sharing requests came through. Felt very inappropriate given we were often at Apple’s mercy. Seems like a consistent cultural issue.
Actual title: Apple changes its rules for personalised advertising in apps
Earlier:
https://news.ycombinator.com/item?id=43047952
Watchdog ponders why Apple doesn't apply its strict app tracking rules to itself (theregister.com)
161 points by Logans_Run on Feb 14, 2025 | 69 comments
I'm already curious what kind of malicious compliance Apple will invent this time. When it comes to that, their creativity knows no bounds.
Smells like another successful lobby attempt by VG Wort. Disgusting.
A monthly headline could honestly just read "Apple treated its own better than rivals" and it would always be relevant
Apple never hid the fact that their apps work better on their devices. They have access to APIs that third parties do not have.
I don’t think it’s a bad thing necessarily.
I do think it's a bad thing and I believe the EU regulators agree.
There are whole classes of applications that are not possible unless low level device data is exposed via APIs.
And since Apple doesn't provide the apps, the apps won't exist until Apple creates them.
Maybe some sort of 1 year lead time would be a reasonable trade off ?
Like let Apple first do the move, flesh out the issues and overall viability and then require them to open the api ?
I don't understand "first do the move"
When you develop a new feature that you have barely tested, is your first step to open a public api ?
What makes it a "bad thing" if competitors have equal access? May the best implementation win.
Maybe build your own operating system? But we are very lucky there are two other superior choices out there, and they have even bigger market-share, Microsoft Windows and Linux.
I keep hearing from people that they’re awesome to use so why do people care about the smallest system available worldwide? Why does anyone care what Apple does or anyone else if they decide to make their own operating system?
iOS is a dominant OS with billions of users. In the US it has the majority market share of the smartphone market.
So whether Apple likes it or not, now their OS is a platform and has different responsibilities compared to your hobby OS that you developed to play with, and accidentally you got 10 users.
Can you share some of these Microsoft Windows and Linux phones that also run the popular apps that you often need to take part in daily life?
You can't because the duopoly prevents you to do it, that's why it's called a duopoly.
As has been evident in many spheres of human activity recently, being brazen about conflicts of interest, is often used as a PR shield for those conflicts.
Sometimes transparency and honesty get weaponized. Especially by actors with centralized power.
(Not arguing against transparency, but against misinterpreting it as always being used in good faith.)
Isn’t the EU regulation specifically about this?
I think it's bad.
You want to handle device rotation smoothly in your in-app browser?
Tough luck, WebKit's _beginAnimatedResizeWithUpdates is private, and only Apple gets to use it in Safari.
Good luck with the animation and scroll position handling. You better hope WkWebView's default behavior works for you, because you don't get to customize it and fix edge cases or the tab previews, like Apple did for their browser.