Please don't ask

Facebook took in $86.0bn in 2020, and $84.2bn of it came from advertising.^{4SECFacebook, Inc. Form 10-K for fiscal year 202028 Jan 2021} Put another way, 98 cents of every dollar came from showing someone an ad. The firm has never pretended to be anything other than an advertising business with a social network attached.

Which makes the events of 26 April worth a pause. On that day Apple released iOS 14.5, the version of the iPhone’s operating system that adds a feature it calls App Tracking Transparency. Apps must now ask permission before tracking a user across other companies’ apps and websites.^{1AppleiOS 14.5 offers unlock iPhone with Apple Watch, diverse Siri voices, and more26 Apr 2021,2AppleData Privacy Day at Apple: Improving transparency and empowering users27 Jan 2021} Apple’s argument is that privacy is “a fundamental human right”, in the words of Craig Federighi, its software chief.^{2AppleData Privacy Day at Apple: Improving transparency and empowering users27 Jan 2021} Facebook’s is that the prompt will hurt small businesses, and the free internet with them.^{3FacebookSpeaking Up for Small Businesses16 Dec 2020}

Paid by the ad. Facebook, advertising revenue, $bn

	Advertising revenue
2018	55
2019	69.7
2020	84.2

Source: Facebook Form 10-K, fiscal 2020⁴

We think both are partly right, and that the interesting question is neither. It is who ends up holding the power once the dust settles.

Start with the case for Apple, which is stronger than Facebook allows. Tracking across apps has been done to most people without a clear request and without a clear reason. A prompt that asks “allow?” is a modest correction, and users may decline it for the simplest of reasons: they would like to be asked. Facebook has itself conceded the power of a clear choice, if only by adding its own pre-prompt and saying it has “no choice but to show Apple’s prompt.”^{3FacebookSpeaking Up for Small Businesses16 Dec 2020}

Facebook’s counter is worth stating fairly. It says that in tests small advertisers lost more than 60% of their sales per dollar spent when they could not use their own customer data, and that publishers saw revenue fall by more than 50% when personalisation was removed from app-install campaigns.^{3FacebookSpeaking Up for Small Businesses16 Dec 2020} Those are Facebook’s numbers, from Facebook’s studies, and the firm has an obvious interest in them. But its filing for 2020 admits that the iOS 14 changes “will limit our ability to target and measure ads effectively.”^{4SECFacebook, Inc. Form 10-K for fiscal year 202028 Jan 2021} Advertising grew by more than half in two years, from $55.0bn to $84.2bn,^{4SECFacebook, Inc. Form 10-K for fiscal year 202028 Jan 2021} and a business built on that scale of precision does not lose it for nothing.

Here is the problem. Privacy is a good, and so is competition, and the two have just come apart. Apple has not removed tracking; it has moved the decision about it to a single gatekeeper that sells phones, runs the App Store and, Facebook claims, operates an advertising platform that “is exempt from the new prompt requirement they’ve imposed on other companies.”^{3FacebookSpeaking Up for Small Businesses16 Dec 2020} Facebook goes further and says the move is “part of Apple’s strategy to expand their fees and services business.”^{3FacebookSpeaking Up for Small Businesses16 Dec 2020} We cannot verify Apple’s motives, and Apple says the rule is about users. Yet a rule that one firm writes, applies to its rivals and exempts itself from deserves more than applause.

There is a respectable defence of the arrangement. Apple’s own apps, it can say, collect data from people who have chosen to buy Apple’s devices, and that first-party relationship differs from following a person from app to app. That is a real distinction. But a distinction that happens to protect the rule-maker’s own revenue is exactly the sort that regulators should test, not assume.

So we would ask three things. Apple should show the same prompt, with the same wording and the same defaults, to its own advertising products as to everyone else’s. It should publish what it measures about the effect on rivals, so that “privacy” can be separated from “convenient”. And lawmakers should write a baseline privacy law, so that a user’s protection no longer depends on the commercial instincts of the firm that happens to make the phone.

That last point is the heart of it. Privacy that arrives as a company policy can leave as one. When the choice between Facebook and Apple is a choice between two firms that each profit from controlling the data, the user has won a prompt and lost, so far, nothing else.

The pop-up asks “Allow tracking?” Regulators ought to ask who the question is really for.