It sounds like they disabled the "advertising ID" OS feature, but there are many other ways to fingerprint a device for advertising. Maybe this will lead to real privacy reform, now that the true risks are apparent. Not to mention ICE using the same data against civilians.
On iOS you can apparently simply check the APFS filesystem creation date and that's stable and unique enough to need almost no disambiguation. And any app can do this with no entitlements
Disabling "advertising ID" on iOS makes it extremely difficult to reliably fingerprint phones. Apple doesn't allow SDKs which attempt to bypass this, so the app would have to have a first party auth of some type.
Disabling "advertising ID" on iOS makes it extremely difficult to reliably fingerprint phones.
You got this flipped. The whole point of "fingerprinting" is to build a stable identifier that works even if a explicit identifier (IMEI or advertising ID) isn't available. And yes, there are shady SDKs that do this without facing repercussions.
Testing that on ten phones is hardly evidence. I am skeptical that the approach described would be very useful for reliable fingerprinting.
IIRC Apple also specifically prohibits exporting device signals like boot time and available disk space, so that SDK would be in violation of their rules if the description is accurate.
That may have been true initially but meta has enough information to heuristically observe unidentified users and compare their behaviors with known consumers. It only takes a few actions to uniquely identify a consumer with a high degree of confidence.
Pretty sure Meta doesn't do that on iOS devices because that'll get you banned from the App Store. They just figured out ways to not need individual fingerprinting.
Comments
It sounds like they disabled the "advertising ID" OS feature, but there are many other ways to fingerprint a device for advertising. Maybe this will lead to real privacy reform, now that the true risks are apparent. Not to mention ICE using the same data against civilians.
On iOS you can apparently simply check the APFS filesystem creation date and that's stable and unique enough to need almost no disambiguation. And any app can do this with no entitlements
Disabling "advertising ID" on iOS makes it extremely difficult to reliably fingerprint phones. Apple doesn't allow SDKs which attempt to bypass this, so the app would have to have a first party auth of some type.
You got this flipped. The whole point of "fingerprinting" is to build a stable identifier that works even if a explicit identifier (IMEI or advertising ID) isn't available. And yes, there are shady SDKs that do this without facing repercussions.
https://www.buchodi.com/i-broke-applovins-mediation-cipher-p...
Testing that on ten phones is hardly evidence. I am skeptical that the approach described would be very useful for reliable fingerprinting.
IIRC Apple also specifically prohibits exporting device signals like boot time and available disk space, so that SDK would be in violation of their rules if the description is accurate.
https://developer.apple.com/documentation/bundleresources/ap...
That article is pure AI slop.
Dude, FAANG still manage to do it, day in day out.
IIRC they actually don't and it materially reduced Meta's profit when Apple rolled out the advertiser ID system.
"Facebook says Apple iOS privacy change will result in $10 billion revenue hit this year" (2022):
* https://www.cnbc.com/2022/02/02/facebook-says-apple-ios-priv...
See also perhaps "It’s not Meta - its APPLE who have screwed us small advertisers":
* https://www.reddit.com/r/FacebookAds/comments/1o85w2q/
I would be even more shocked if instead of adapting, they’ve continued to lose $10b a year
Wow that number is line an order of magnitude or more than I expected it would be
Won't someone please think of the poor advertisers? /s
That may have been true initially but meta has enough information to heuristically observe unidentified users and compare their behaviors with known consumers. It only takes a few actions to uniquely identify a consumer with a high degree of confidence.
Yes, it was temporary and Meta revenue and profit at all time high (before data center buildout).
Pretty sure Meta doesn't do that on iOS devices because that'll get you banned from the App Store. They just figured out ways to not need individual fingerprinting.
Apple does not enforce the rules uniformly
Do they really allow any app to be downloaded on mil phones?
Everything they do is a framework for consumer protection laws.