Skip to content
Ideas Data Strategy2021-10-27

iOS Privacy Changes are starting to bite, and there’s more to come

Mark Bulling

Photo by Annie Spratt on Unsplash

Since the most recent changes to Apple’s iOS15, many in the industry are still digesting what these changes mean to the broader digital ad ecosystem. At the same time, the changes from iOS14 are the ones currently generating the most headlines in the industry as various ad platforms’ Q3 earnings are being released this month. 

While Facebook and Snap have both highlighted the headwinds that this has generated for their ad revenues, other platforms (like Twitter) have indicated that they’ve seen less of an impact on their businesses.

Why the impact’s being reported now and why it isn’t consistent

There are a variety of reasons why ad platforms have reported being impacted by Apple’s App Tracking Transparency (ATT) changes, which was first introduced in iOS 14.5 and allowed users to reduce how much personal data can be tracked by companies. For one, ATT has significantly reduced ad platforms’ ability to tie together ad exposure and conversion at a user level. Factors such as the mix of business between brand and performance marketing spend, the size of advertisers using the platform, and user mix between iOS and Android, have determined the size of the headwinds ad platforms are facing. 

Platforms have also differed in how well they have been able to navigate these headwinds and transition to alternative ways of measurement and targeting with less data available on conversions. All of this is set against the backdrop of the economy continuing to recover, and so isolating the impact of these changes from macroeconomic factors adds another layer of complexity to any analysis. 

Understanding the rollout of iOS is an important factor in understanding the impact that the ATT changes has on the industry. While ATT was announced as part of iOS14, it wasn’t released until the iOS14.5 update at the end of April, and consumer adoption of the updated iOS only became material towards the end of June. That left much of the industry unscathed by the changes during Q2, and only now as Q3 earnings are being released, has the impact started to be felt. 

As noted on the Facebook earnings call, the impact of these changes is also not impacting all advertisers equally. Advertisers with higher numbers of conversions are likely to be less impacted than advertisers with lower numbers of conversions as the latter are more likely to be impacted by the Privacy Threshold which requires a certain number of app installs each day in order to aggregate and share back to Apple’s attribution mechanism, SKAdNetwork. These advertisers are also likely to benefit less from the conversion modeling alternatives that are being developed. 

The changing dynamics of the app install ecosystem

Beyond the earnings reports, the impact can also be seen in a reshaping of the mobile-app-install ads ecosystem, which has been most affected by the adoption of ATT. AppsFlyer, a mobile measurement partner (MMP) used mainly by non-gaming apps, recently released its latest Performance Index where Facebook lost its top spot to TikTok in the Power Index (a measure that balances scale and efficiency of app install ads), while Apple Search Ads took top spot in its Retention Index (which captures how well apps retain ad-acquired users over time).

The flipside of the negative impacts reported by ad platforms is the beneficial impact being Apple’s ad business is experiencing, predominantly in Apple Search Ads where there are varying reports by MMPs of around 60% of attributable app installs now being attributed to Apple Search Ads. 

What comes next

The changes in iOS15 focus on the next layer of the onion beyond the device identifier and the next set of user attributes that are often used for tracking purposes: IP address and email address. While the acknowledgement of the privacy risks with both of these are not new, and have been focused on in previous versions of iOS, there is now more focus on turning off the spigot for these too. 

Private Relay is a new feature included as part of the rebranded iCloud+, a service that adds a layer of obfuscation between a user and the website that they are visiting, hiding the IP address and precise location of the person in the requests that are being sent and returned from the website. 

Apple is also building on the "Sign in with Apple" integration that was part of iOS 14 and provided an alternative to the single sign-on services offered by Facebook, Google and others. This service created a random, unique email address that hides the user's actual email address from apps. Apple is now extending this into Safari with the “Hide my email” function, which appears when someone is signing up for websites that need an email address. Through enabling site specific email addresses, this starts to break down the utility of treating an email address as a match key with other third party services. 

Apple also announced Mail Privacy Protection, a feature that "hides your IP address, so senders can’t link it to your other online activity or determine your location. And it prevents senders from seeing if and when you’ve opened their email." This is similar to Private Relay in that it also hides IP addresses from advertisers; it also has the ability to hide locations and understand what proportion of people are opening emails. This change is expected to hinder email marketers in their ability to see performance of their campaigns and understand which messaging is most effective at driving open rates.

Default settings are a substantial driver of the adoption of any software feature. ATT essentially changed the default of Identifier for Advertisers sharing from on to off, so the default settings will also matter for the adoption of Private Relay and Mail Privacy Protection. Both features are currently set to “off” by default, with Private Relay additionally being positioned as a beta function. If and when these default settings change, it will have a significant impact on solutions, which make use of either IP addresses and email addresses.