Apple can't protect you from data trackers forever. No one can

Your data can run, but it can't hide.

Alfred Ng Senior Reporter / CNET News
Alfred Ng was a senior reporter for CNET News. He was raised in Brooklyn and previously worked on the New York Daily News's social media and breaking news teams.
Alfred Ng
5 min read
Eye lit up on huge digital display screen
Saul Gravy/ Getty Images

The battle to protect your privacy is like a roller coaster, with breathtaking highs and turbulent lows. It is, after all, a constant game between the technology that guards your information and the trackers that find new ways to profile you.

Apple  hit a high point for  privacy  last week.

Watch this: MacOS gets better privacy and security features

At its Worldwide Developers Conference, the consumer electronics giant introduced tools to protect your data by blocking "device fingerprinting" and social media trackers on its Safari browser.

"We believe your private data should remain private," Craig Federighi, Apple's senior vice president of software engineering, said at WWDC . "Not because you've done something wrong or have something to hide, but because you have a lot of sensitive data on your devices and we think you should be the one in charge of who sees it."

Apple's on the case, so there's nothing to worry about now, right?

Actually, there is. While privacy experts applaud Apple's new features, they say it's more like putting a Band-Aid on the internet's massive privacy wound. That a company as massive and influential as Apple could struggle to adequately protect its users underscores the lengths to which trackers will go to get at your personal information. After all, Apple's move pits it directly against an industry that includes Facebook and Google -- companies that make it their business to track your information for targeted advertising. 

And these companies are very good at what they do.

"There is a long history of great success in bypassing these [trackers]," said Lance Cottrell, the founder of Anonymizer and chief scientist at security company Ntrepid. "You'll see advertisers worry that the world is coming to an end, and then pretty quickly, they seem to work around it."

Public concerns over private information are at a boiling point. High-profile incidents like Facebook's Cambridge Analytica scandal hit close to home for millions of people online. People are becoming more aware of how much data tech giants are harvesting from them. Lawmakers are taking action, including the European Union's adoption of a massive privacy policy called the General Data Protection Regulation, or GDPR.

Beyond legislation, there are plenty of online resources that can help you take on trackers, too. Tools like Privacy Badger and Ghostery look to block data trackers, which can mine for information like your search history, your social media activity and who you are.

But it's a never-ending battle.

"There's always a cat-and-mouse game," Jeremy Tillman, the director of product at Ghostery, said, noting the breadth of trackers out there.

The Ghostery privacy tool has thousands of trackers in its database, and it's adding about 20 to 30 new trackers per week.

Even that's still not enough though, he said. "There are trackers that don't end up in our database."

One-track mind

Apple may be moving to protect your privacy, but it's severely outnumbered.

Cottrell estimates that when you connect to a website, you're likely connecting up to at least 20 different companies on one page. Their trackers can come as ads, Like buttons from Facebook, images and pixels -- tiny, nearly invisible tracking tools that you'll never notice.

"Just by that one-by-one pixel, Facebook and other companies can embed a huge amount of code to identify you and track you," Cottrell said. "That's really where the problem comes in."

In a letter published on Monday, Facebook told senators that by April 16, its Like button was on 8.4 million websites and the Share button was on 275 million web pages, while there were 2.2 million Facebook pixels installed on websites. 

A popup prompt says, "Do you want to allow 'video.example' to use cookies and website data while browsing 'news.example'? This will allow 'video.example' to track your activity." The prompt offers the options "Don't Allow" and "Allow."
Enlarge Image
A popup prompt says, "Do you want to allow 'video.example' to use cookies and website data while browsing 'news.example'? This will allow 'video.example' to track your activity." The prompt offers the options "Don't Allow" and "Allow."

An example of the prompt Safari will show you if you want to interact with part of a website that requires third party cookies.


These trackers use tactics like device fingerprinting, which allows advertisers to know who's viewing their content based on data your browser gives over. The chances that visitors to a website have the exact same settings, fonts, plug-ins and browser version as you are pretty small, and it allows trackers to set up "fingerprints" for each device.

So even if you erase all your cookies, Cottrell said, often it doesn't matter because trackers can recognize you through those fingerprints.

Across more than 144 million page loads, Ghostery found that Google's trackers were on nearly two-thirds of those pages. Facebook's trackers were on 27 percent of them. And those two companies are only the most recognizable names.

Tillman said there are thousands of other companies online that do the exact same thing that the average person has never heard of. When Ghostery realized it couldn't keep up with all the new trackers popping up each week, it started relying on artificial intelligence to help it scale up against the scourge.

Apple's privacy features have a similar approach, relying on what the company calls Intelligent Tracking Protection, or more specifically ITP 2.0.

It's designed to detect tracking cookies, whether from Facebook or one of the thousands of third parties you don't know about and then automatically block them based on behavior, and not a blacklist.

The tools are only available for Apple's operating systems , and while the company has the best-selling smartphone of 2018 (so far), the majority of the world is still using phones running Google's Android mobile software. That's been the biggest challenge for privacy tools: Even if they're available, no one is using them. As a result, data trackers will continue to flourish.

"If you had 5 billion people using Ghostery, then yeah, trackers will change," Tillman said. "If you look at all the people using ad-blocking tools relative to the number of users on the internet, we're an annoyance, but not so much a threat."

Track to the future

Privacy tools will never fully kill off data trackers, but it's a start.

As the classic G.I. Joe PSAs say, knowing is half the battle. And when a major player like Apple puts these data protection features in by default, a lot more people are going to be aware, Tillman said.

Anytime there's a major data scandal, he sees a spike in people interested in privacy tools. When Facebook's Cambridge Analytica scandal broke, even though it had nothing to do with third-party trackers, he saw a major uptick in people looking for Ghostery.

"If there's been a silver lining to the Cambridge Analytica fiasco, it's that it raised the general awareness among the average person quite a bit," he said.

But privacy advocates can't just rely on multiple data scandals to get the word out. That's why more companies, like Apple and Firefox maker Mozilla , have taken a more aggressive stance for privacy, in an effort to stop data trackers.

Even if tech titans take on trackers, it won't take long for advertisers to find a way around them. Data trackers have become too ingrained in how people go online, and a trackerless internet would be a completely different experience, Cottrell said.

"It would take a huge revolution in the way the internet functions to have that change meaningfully," he said. "We've all been trained so early to expect the web to be free. That requires online advertising, which is ineffective unless it's targeted."

Blockchain Decoded: CNET looks at the tech powering bitcoin -- and soon, too, a myriad of services that will change your life.

Security:  Stay up-to-date on the latest in breaches, hacks, fixes and all those cybersecurity issues that keep you up at night.