Mobile Networking · Network Privacy · Lesson 4 of 4

Trackers & Ad Networks

Find out how apps track you for ads and which phone settings push back.

Who's Watching Inside Your Apps

Many free apps earn money from ads. To show ads and measure them, developers often add ready-made code from ad networks and analytics companies, called an SDK (software development kit). That code runs inside the app and can send data to its own servers, such as which screens you open, your rough location or what you buy. You saw this in the proxy lab, where a weather app sent a device ID to analytics.tracker.example.

A tracker that appears in hundreds of apps can link your activity across all of them. The easiest way to link it is an advertising ID, a unique code your phone gives to apps for ads.

On Android, the ad ID comes from Google Play services. You can reset it, which gives trackers a fresh code. Starting with Android 12 in late 2021, you can also delete it. After that, apps that ask get a string of zeros. Look for an Ads page in your privacy settings, though where it sits varies by phone.

A VPN does nothing about any of this, since the tracking happens inside the app.

Asking Before Tracking

Apple calls its ad ID the IDFA, short for Identifier for Advertisers. Since iOS 14.5, released in April 2021, apps must ask your permission before they track you or read that ID. This rule is called App Tracking Transparency (ATT).

When an app wants to track you, a pop-up asks whether to allow tracking across other companies' apps and websites. If you tap Ask App Not to Track, the app gets an IDFA made of all zeros. You can also turn off Allow Apps to Request to Track under Privacy & Security, then Tracking, in Settings. Every app is then treated as if you said no.

Apple's rules also ban workarounds such as fingerprinting, where a tracker combines details about your device to build its own ID. That ban is a policy enforced through App Store review, which is harder than switching off an ID, so some tracking can still slip through.

ATT also leaves an app free to collect data about what you do inside that app. It covers linking your data with other companies.