UDID to IDFA FUD

On Tuesday, I was browsing my usual sources of news when I found this post on Bruce Schneier’s blog , with the ominous headline “Apple Turns on iPhone Tracking in iOS 6”.

The post linked to this piece from Jim Edwards, which carried this headline:

Apple Has Quietly Started Tracking iPhone Users Again, And It’s Tricky To Opt Out

By those headlines, I assumed this would be a repeat of the Locationgate thing from 2011. Ah, but no: this was about ad tracking, and Apple’s switch from UDID (Unique Device Identification) to I(D)FA, which stands for “Identifier for Advertising”.

This whole thing is a bunch of mongering crap based on gross distortions of elements of truth.

In iOS 4 and prior, Apple allowed advertisers and developers access to a device’s UDID. This is a hardcoded, unique identifier assigned to each iPhone, iPod Touch, and iPad. While the UDID is effectively anonymous, only assigned to a device rather than a particular user, some advertisers and developers with little concern for privacy began tying the device ID with other information they could collect, such as their name, phone number, email address, and so forth.

In 2011, Apple let developers know that they would be rejecting apps that continued to access UDIDs. They phased out most third-party access to that device ID in iOS 5, and did so completely in iOS 6 due to the obvious security implications. This meant that for the past year, most advertisers were unable to add any sort of user tracking code.

However, in iOS 6, Apple introduced a new identifier specifically for advertising purposes called IDFA. IDFA is a huge improvement over the old ID because it’s temporary, it’s explicitly for ads, and can be disabled. This makes me wonder why the aformentioned piece by Jim Edwards makes it sound like Apple is snooping through your phone for the explicit purpose of selling you to advertisers:

The company has started tracking users so that advertisers can target them again, through a new tracking technology called IFA or IDFA. […]

In iOS 6, however, tracking is most definitely back on, and it’s more effective than ever, multiple mobile advertising executives familiar with IFA tell us. (Note that Apple doesn’t mention IFA in its iOS 6 launch page).

Now, Jim Edwards is no idiot. He knows that he needs to mention the obvious opt-out ability and ensure you know that Apple is indeed not shilling you to advertisers. But Business Insider needs their ad revenue¹, hence the linkbait title, followed by phrases like these:

iOS 6 users are able to turn off tracking, which they weren’t before. […]

The IFA does not identify you personally — it merely provides a bunch of aggregate audience data that advertisers can target with ads.

Edwards does raise a good point with regards to the way Apple has implemented the setting. One would assume that it’s under the Privacy submenu, but it’s actually under General, then About. Confusing and buried, but the ability to disable it, and the temporary identification code presents a significant improvement over the old method. While I personally have switched on the “Limit Ad Tracking” switch because of my own concerns with ad tracking privacy, the fact of the matter is that this is much, much better than Apple’s previous implementation.

If you’re concerned, Jacqui Cheng of Ars Technica has a good explanation of the transition.

There you have it. Just enough FUD if you’re browsing Business Insider headlines to keep their ad revenue high.