What the New iPhone Privacy Features Will Really Do

Consumer Reports has no financial relationship with advertisers on this site.

Apple announced new privacy features this week that are scheduled to roll out to iPhone and other Apple hardware later in 2020. The company says the changes will give consumers much more control over the extent to which companies peek over their shoulder as they use apps and websites.

Privacy advocates and advertising executives interviewed by Consumer Reports agree that the features could reduce the amount of personal information siphoned off from the gadgets we use. But a lot will depend on how the rules are implemented.

“This is progress, but I don’t know how effective it’s going to be,” says Justin Brookman, director of privacy and technology policy for Consumer Reports. “It comes down to whether Apple is really going to enforce new rules for app developers, and it’s not entirely clear that they will.”

Apps devoted to dating, gaming, social media, health, and everything else you can think of routinely collect lots of information that’s used to build marketing profiles on individual consumers.

Starting this fall, Apple users will have to grant permission before an app can use tracking technology, the same way apps already ask permission to access the phone's location, microphone, or contacts.

“We believe tracking shall be transparent and in your control. So moving forward, App Store policy will require apps to ask before tracking you across apps and websites owned by other companies,” said Katie Skinner, Apple's manager of user privacy software, at the company's World Wide Developers Conference, where the new features were announced.

In a second change, the App Store will show a standardized list of what kind of data an app collects, alongside the familiar pieces of information you already see, such as customer ratings, pricing, and the version history.

The company is also making a number of additional changes related to privacy as it rolls out iOS 14 and other new software. For instance, on iPhones, a light will come on if the camera or microphone is being used. And you’ll be able to limit the accuracy of location data shown to apps, instead of having to either grant or deny access altogether. That will let you harness features like weather forecasts, or restaurant recommendations for your town, without sharing your location using a GPS level of precision.

Here’s more information on the major new privacy features changes, and how well experts think they’ll work.

May This App Track You?

This fall, your iPhone may start bombarding you with prompts as one app after another asks permission to track you. But to understand what that permission actually means, you need to step into the world of advertising technology.

To make money, ad-tech companies connect tidbits of information about you from as many apps and websites as possible, building up detailed portraits that can cover everything from what videos you flip through to how much time you spend playing mobile games to the stuff you buy and who you’re friends with. They combine that with details like your age, race, gender, income, daily travel patterns, and other data to make inferences about you that could make you an attractive target for advertisers.

This kind of tracking is the rule, not the exception. Consumer Reports found the prescription discount app GoodRX sending data about medications to companies such as Google and Facebook. In another CR study, we found a number of period-tracking apps sharing data with other companies.

There’s no central repository for all the different sources of data that marketers want. So to link it all to you, ad-tech companies that collect information from an app developer or website also record ID numbers that are associated with your smartphone. Then they match up the IDs to piece all those pieces of information together.

There are a lot of these identifiers, but according to rules set by Android and iOS, companies are supposed to use only something called an advertising ID. That’s meant to protect your privacy, because you can reset advertising IDs to make it harder for companies to track you.

Okay, back to that new permissions pop-up. Apple is now telling developers that they can’t collect your advertising ID unless users give them the go-ahead. This isn’t going to eliminate all tracking in apps and websites—the advertising ID is just one tool available to technology companies. But it may turn out to be a big step forward. And privacy experts are recommending that iPhone users take advantage of the new feature.

“Apple users should block app tracking from every app using the new features announced this week,” says Zach Edwards, a privacy researcher and the founder of analytics firm Victory Medium. Edwards worked on a recent study that found apps including Grindr, OkCupid, Tinder, and the period-tracking apps Clue and MyDays sharing data about consumers with dozens of other companies. Some of the apps shared data that revealed users’ sexual orientations and religious beliefs. And advertising IDs formed part of the data being shared.

Nutrition Label for Privacy

Apple is also making a significant change to its App Store. Later this year, you’ll start finding information about what kinds of data apps collect—such as location, purchases, contact information, ID numbers, and purchase history—with some details about how it might all be used.

The format is being modeled after the nutrition labels on food packaging, an idea that’s been promoted for years by Lorrie Faith Cranor, a professor of security and privacy technologies at Carnegie Mellon University, along with other privacy experts.

“Apple’s approach is a great start, but it appears to be very simple," Cranor says, "so it does raise some questions as to whether it provides enough information to consumers, or if they will still have to go read a long privacy policy to find out why a particular piece of information is being collected.”

Done right, these “privacy nutrition labels” may have an even bigger impact than the actual controls Apple is giving consumers, according to Serge Egelman, a digital security and privacy researcher at the University of California, Berkeley, who studies how apps gather consumer data. (Egelman is one of the founders of AppCensus, a company that has worked with Consumer Reports on a study of tracking in Android apps.)

Whether or not consumers get enough details to make informed decisions, “it will be an important tool for people who have the expertise and the ability to verify the statements developers are making,” Egelman says. “I think that will probably result in better behavior or more enforcement action.”

How Well Will the Tools Work?

To a large extent, both the tracking permission feature and the app store’s new privacy labels rely on developers to be accurate—and honest—about their practices.

That may be a problem. In some cases, developers don’t even know what kind of data their apps collect because they use code provided by third parties. “Our research has found that app developers tend not to know much about privacy, and many of them don’t work for big companies where there are lawyers or privacy engineers to help them,” Cranor says.

Experts worry that apps may also abuse loopholes Apple has put in place, such as an exception that allows apps to collect data without permission if it’s to help prevent fraud.

According to an Apple spokesperson, the company will work to verify developers’ claims before the apps are approved.

Advertisers seem to be taking these changes seriously. “As a baseline, asking consumers for permission in this way is likely to reduce the amount of identifiers available by a hefty amount,” says Ari Paparo, CEO of Beeswax, an advertising tech company. “This will certainly mean that apps make less money on ads, and less data will be sent around to advertising companies.”

Apple did not respond to questions about what consequences developers might face for breaking the rules. Some experts say Apple has a mixed record on enforcing privacy rules that have already been in place.

“I expect there's going to be a concerted effort from the advertising industry to create a new tracking mechanism that will circumvent these privacy controls,” says Egelman, the Berkeley researcher.

More from Consumer Reports:
Top pick tires for 2016
Best used cars for $25,000 and less
7 best mattresses for couples

Consumer Reports is an independent, nonprofit organization that works side by side with consumers to create a fairer, safer, and healthier world. CR does not endorse products or services, and does not accept advertising. Copyright © 2020, Consumer Reports, Inc.