For years, Apple CEO Tim Cook has been the most vocal privacy champion among all of big tech’s top leaders. But within Apple, a decision to curtail ad tracking of iPhone users in 2020 sparked an intense debate about just how far to push privacy changes poised to upend the digital advertising industry.
On one side of the discussions was Craig Federighi, Apple’s software chief. He oversaw a team of privacy-minded engineers who wanted to curtail the powers of an Apple tool that unscrupulous advertising companies, mobile developers and data brokers were exploiting to track the behavior of iPhone users, according to people with direct knowledge of the discussions. On the other side were groups reporting to Eddy Cue, head of Apple’s services and advertising businesses, and Philip Schiller, then the company’s top marketing executive, who led its App Store. Cue's and Schiller's teams argued for more-cautious action against the tool, given that many developers relied on it for advertising revenue. Schiller's group also worried about potential damage to App Store revenues, though Schiller himself was in agreement with Federighi and his team, the people said.
In the end, the Apple leaders reached a solution. The company required app developers to ask users whether they wanted to allow their online activities to be tracked across websites and apps operated by companies other than the developer. Developers couldn’t use the tool anymore to track users who opted out but instead had to rely on an inferior system developed by Apple that better protected user privacy. For many companies in digital advertising, the impact of Apple’s changes—which the company began to enforce last April—has been seismic. That’s especially true for Facebook’s parent company, Meta Platforms, which expects the changes to shave $10 billion off its revenues this year because of their impact on the company’s prodigious data collection practices.
The Takeaway• Apple’s privacy team leader helped create controversial tracking technology
• Erik Neuenschwander led charge to later curtail use of the technology
• Unscrupulous data brokers, not Facebook, were primary target of changes But in interviews with The Information, people with direct knowledge of Apple’s privacy deliberations stressed that Meta wasn’t the primary target of the company’s changes, despite a long history of thinly veiled rhetoric from Cook viewed as critical of the company’s practices. Instead, Apple was going after the most egregious forms of abuse—for example, weather apps that sold data about users’ locations to brokers, the people say. And what particularly galvanized the Apple executives into action, these people say, was a dawning recognition that it had, in effect, created a monster in the digital tracking tool that became a pillar of the ads business and the surveillance industry. “They opened a proverbial Pandora’s box,” said Eric Schmitt, an ad tech analyst at Gartner. At the heart of the Apple effort to shut that box was Erik Neuenschwander, an influential 15-year veteran of the company who heads up its privacy engineering team. His role is all the more noteworthy because he was the Apple employee who over a decade ago came up with the idea for the now controversial tracking tool, called identifier for advertisers, according to people familiar with its development. Neuenschwander’s original vision for the IDFA, as it is better known, was as a way to improve user privacy by giving them the option to turn off tracking while still providing what Apple believed was a harmless tool to deliver targeted ads, people familiar with the matter said. But over time, as the ad industry evolved, he and his privacy team grew increasingly concerned that advertising practices were becoming too invasive, as companies connected user data across apps and services into mega-profiles. Meanwhile, a cottage industry of intermediaries was abusing the IDFA to go even further by tracking and surveilling people around the world, including their physical locations. In early 2020, The Wall Street Journal exposed one such form of surveillance in a report about federal agencies that used cell phone advertising identifiers to help locate targets for immigration enforcers. Neuenschwander, 44, has become a strong opponent of tracking and surveillance and believes the only foolproof way to prevent bad actors from compromising user privacy is for Apple to minimize the data it can collect about users in the first place, according to people who have worked with him. In a presentation last year to introduce his team to other groups at Apple, he showed a slide that simply read: “Disempower Apple Inc.” Apple’s privacy changes—known as app tracking transparency, a feature of its iPhone operating system that it began to enforce last April—are likely to reverberate throughout the tech industry for years to come. The vast majority of iPhone users have chosen to opt out of allowing their online activities across apps to be tracked, with only 26% of global users on average opting in to apps that show the prompt as of last month, according to Flurry Analytics. While Meta may be the biggest casualty of Apple’s actions, it has company in its suffering. Ad tech firm Lotame estimated that the changes shaved off 7% of Twitter’s and YouTube’s revenues and 13% of Snap’s revenues in the third and fourth quarters of last year. And Google—whose ads business has held up amid Apple’s changes—last month followed in the iPhone maker’s footsteps by announcing plans for its own version of Apple’s app-tracking changes for its mobile operating system, Android. Brian Bowman, CEO of mobile app advertising agency ConsumerAcquisition, is among those who have felt the pain of Apple’s privacy changes. Bowman, whose agency has managed $3.5 billion of advertising spending for clients, said that on average, his clients’ revenue fell 30% in the third quarter of 2021 compared to the second quarter of that year due to the rollout of ATT. He said Apple should have consulted with the ad industry more closely before implementing ATT. “Apple built the apps industry to be advertising-heavy and they took away the ability to make advertising functional,” said Bowman. “These guys aren’t acting like a partner.” By contrast, he said, Google is participating in an open dialogue with the ad industry, delaying any changes to its own mobile advertising identifier for two years and asking for feedback. “At Apple, we believe privacy is a fundamental human right, which is why we design every product and feature from the ground up with privacy in mind,” Apple said in a statement provided by a spokesperson. “Our teams work collaboratively across Apple, putting the same effort into privacy innovation as we put into all of our product designs, and the result is greater choice and superior products for our customers. App Tracking Transparency is an example of how this purposeful approach has delivered increasingly granular control for users.” Neuenschwander didn’t respond to a request for an interview. Unscrupulous Developers The creation of the IDFA became one of the first projects for Neuenschwander after he took over Apple’s product security team in 2011. He stepped into the role in the wake of a scandal—dubbed locationgate in the press—over the revelation that Apple had stored user location data in an unencrypted file on users’ iPhones. Apple gave Neuenschwander’s team a mandate to review internal requests for user data and to provide early input on privacy features developed by other parts of the company to ensure they met Apple’s standards. At the time, iPhones had unique identification codes embedded in their hardware, which advertisers had begun to use to link people’s activities across apps and services on their devices. But the hardware-based codes had serious drawbacks because they couldn’t be changed or turned off. If people sold or gave away their iPhones, for example, advertisers couldn’t tell different people were using the devices. As an alternative, Neuenschwander’s group came up with the IDFA, a software identifier comprising 32 random letters and numbers that would reset when a user sold or gave away the phone, meaning that data about the new owner wouldn't be mixed in with data from the old owner in advertisers' databases. The team also added a privacy-friendly feature that allowed users to turn off the software identifier by flipping a switch in the iPhone’s menu. While that option concerned some advertisers, it didn’t deliver a major shock to the industry because the IDFA switch was buried under multiple iPhone menus. In the first few years after Apple introduced the IDFA, the percentage of users who chose to limit ad tracking by turning the feature off was in the single digits, according to three people familiar with the situation. Eventually, the ad industry began to use the IDFA in ways the privacy engineering team hadn’t intended, building an entire tracking ecosystem around it. Unscrupulous developers started using it to gather location data on users and sell that information to data brokers for additional revenue.
Apple's Erik Neuenschwander speaks virtually during an Apple developer conference in June 2021. Photo by Bloomberg
Meanwhile, Apple’s privacy engineering team became aware that some developers weren’t honoring the wishes of users who turned off the IDFA switches on their phones—a violation of Apple’s policies that was difficult to detect. In 2014, Neuenschwander’s team added new rules governing the use of the IDFA to prevent this behavior. They made no technical changes, however, to force developers to honor these rules, and many developers ignored them.
Around 2016, Neuenschwander’s team went further, making it impossible for developers to ignore do not track requests from iPhone users. Anytime someone disabled the IDFA on their phone, a string of zeros would replace the identifier so developers couldn’t see it. But they eventually found workarounds that allowed them to still keep tabs on users’ habits.
Around this time, Neuenschwander privately began telling colleagues he regretted creating the IDFA, in part because others like Google followed with a similar identifier a year later, according to people who have worked with him. The growing ubiquity of the practice troubled Neuenschwander, a computer programmer who had a background in privacy from his days at Stanford University, where he majored in symbolic systems, an academic program combining computer science with philosophy, linguistics and psychology.
How Far to Go
Meanwhile, as Apple’s privacy team was playing a cat-and-mouse game with developers, Cook began to intensify his criticism of data collection practices.
In 2015, he publicly declared that privacy was a “fundamental human right” and that Apple didn’t believe in monetizing user data collected in exchange for free services. In 2018, Cook gave an interview in which he was asked what he’d do if he was in the situation of Mark Zuckerberg, CEO of Meta, then called Facebook, which was in the midst of the Cambridge Analytica scandal. Cook said he wouldn’t be in Zuckerberg’s situation.
"The truth is we could make a ton of money if we monetized our customer, if our customer was our product," Cook said. "We’ve elected not to do that."
Apple's Craig Federighi waves while arriving at a court hearing in Oakland, Calif., in May 2021. Photo by Bloomberg
Before Apple could make any such public announcement, three Apple senior vice presidents—Federighi, Cue and Schiller—had to come to a consensus about how far the feature would go in crimping tracking and how Apple could soften the expected impact the changes would have on developers.
In a series of meetings that began in fall 2019, Schiller and his team weighed in on the potentially serious impact of the IDFA restrictions on revenues for the App Store, which Schiller oversaw as the head of Apple’s marketing organization at the time. While Apple doesn’t take a cut of developers’ advertising revenues on the iPhone, it benefits indirectly from the ad ecosystem.
That’s because the mobile ads that run inside apps often promote the downloading of other apps. And many of those apps in turn generate revenue when users buy them outright or make in-app purchases—transactions that Apple does take a cut of. If new restrictions on the IDFA resulted in users seeing fewer ads, they might download fewer apps, Schiller’s camp worried, according to people familiar with the debate.
Schiller’s team was also concerned that the IDFA changes could push developers and advertisers to shift their focus and spending to Android apps, where they could more accurately measure the impact of ad spending, the people said.
Meanwhile, Cue’s team also had concerns about going too far in eliminating tracking. Because he was in charge of running Apple’s own iAd advertising network—which places search ads on the App Store and display ads in Apple News—Cue’s team was especially sensitive to the consequences of kneecapping the IDFA.
Cue was also an important player in the discussions because his organization oversaw the development of an existing analytics tool called SKAdnetwork that Apple intended to promote as an alternative to the IDFA for measuring the effectiveness of ads. While the tool protected user privacy, most developers had shunned it since Apple released it in 2018 because they couldn’t obtain the same kind of granular user data available with the IDFA.
Developers Scramble
The trio eventually settled on a plan: iPhone users would have a choice of whether to opt into app tracking, which Apple executives felt was more defensible if developers and the online advertising industry pushed back, people familiar with the discussions said. They would also be able to do this on a per-app basis, which Apple executives also felt would benefit advertisers, a person familiar with the matter said. This was a big change from Apple’s earlier IDFA controls, which enabled tracking across all apps by default.
Four people in Federighi’s organization tackled the project in the fall of 2019 and were given roughly nine months to complete it in time for Apple’s 2020 Worldwide Developers Conference, a June event that often showcased new software features. They were tasked with making sure the feature worked technically, as well as consulting with Apple lawyers to tread carefully around decisions that could raise regulators’ eyebrows.
For example, they discussed the precise wording of the ATT tracking prompt so it didn’t look like they were pushing users in one direction or another. They even labored over the definition of the word “tracking” in Apple’s developer rules, narrowly defining it as the linking of user data collected from the developer’s app to other user data from another company’s app or services.
That meant developers including Apple could continue collecting user data to improve their own services as long as they didn’t share it with other parties. The ad industry and Apple’s competitors have criticized the nuance, as it gives developers with a large network of apps and services—including Apple’s own ads business—a clear advantage.
To placate developers and advertisers affected by a likely surge in users opting out of tracking, Apple decided to make improvements to SKAdnetwork so the advertisers weren’t completely in the dark about how their ads were performing. Cue’s group initially didn’t want to spend resources improving the tool because people hadn’t used it in the past, but went ahead anyway and made some improvements to the tool. They have been widely seen as inadequate when compared with the IDFA, though.
“SKAdnetwork is a joke,” said Bowman, the app advertising agency executive. “It doesn’t function well. Apple doesn’t have the mettle to do what it takes to build a functional ad network.”
Apple announced ATT at its developer conference in June 2020, promising to release the technology in the next version of iOS, which it typically released with the latest iPhone in September. In the meantime, representatives from Facebook, Google and others started meeting regularly with Apple to better understand the changes, discovering that the IDFA would be toggled off by default on each app unless a user opted into tracking for that specific app. Google’s chief business officer, Philipp Schindler, was among the top tech executives who