iOS Internals · iPhone Privacy Controls · Lesson 3 of 5

Tracking & Privacy Labels

See what Ask App Not to Track really blocks and how to read an app's label.

Tracking, by Apple's definition

You met App Tracking Transparency (ATT) in Mobile Networking. Since iOS 14.5, an app must ask before it tracks you, and if you tap Ask App Not to Track, it gets an advertising ID made of all zeros. Now let's look closer at what the rule actually covers.

Apple defines tracking as linking data about you from one app with data from other companies' apps and websites, for targeted ads or ad measurement. Sharing your data with a data broker, a company that collects and sells personal information, also counts.

The prompt reads roughly "Allow [app] to track your activity across other companies' apps and websites?" Below that, you'll see a line written by the developer. Like the purpose strings in module 1, it's the developer's own pitch, and it often tries to sound helpful, for example "to show you ads that matter".

Apple's rules add a few protections:

• An app can't make you allow tracking to use the app or its features, and it can't offer rewards such as gift cards for saying yes.
• If you say no, the app can't swap in your email address or a device fingerprint to track you another way.

Here's the catch. iOS enforces only the zeroed ID. Everything else is policed by App Store review, so a rule-breaking app may not be caught right away.

ATT also leaves some things alone. An app can still collect data about what you do inside it, and it can still show you its own ads based on that. ATT is about linking your data with other companies, not about all collection.

To review your answers, go to Settings, Privacy & Security, Tracking. Turning off Allow Apps to Request to Track at the top treats every app as if you said no.

Reading a privacy label

Every app on the App Store has a privacy label, which Apple calls a Privacy Nutrition Label. You'll find it on the app's page, under App Privacy. Like the label on a cereal box, it gives you a quick summary before you download.

A label sorts the data an app collects into up to three groups:

• Data Used to Track You: data used for tracking as Apple defines it, so linked with other companies' data for ads, or shared with data brokers. An app with items here should also be showing you the ATT prompt.
• Data Linked to You: data connected to your identity, through your account, your device or other details.
• Data Not Linked to You: data the developer collects but says it strips of identifying details first.

A label can also say Data Not Collected. Tap into a group and you'll often see the purposes too, such as Analytics, App Functionality or Third-Party Advertising. Location even appears as Precise Location or Coarse Location, which mirrors the switch you met in module 2.

"Collected" has a specific meaning here: sending data off your phone in a way that lets the developer, or partners whose code is in the app, keep it longer than needed to answer that one request. Data the app uses only on your phone doesn't count.

Now the important limit. Labels are self-reported. Developers fill in the answers in App Store Connect, and Apple's own developer pages say the developer is responsible for keeping them accurate. Researchers have found apps whose labels didn't match what the apps actually did. Treat a label as the developer's promise, not as proof.

That's why it helps to check behavior too. The next module shows you a tool that reports what apps actually do on your phone.