Adtech has a plan to beat Apple's tracking crackdown — but it has weaknesses

Adtech has a plan to beat Apple's tracking crackdown — but it has weaknesses The adtech industry has a plan to mitigate the effect of the ad tracker crackdown implemented by John Ternus' Apple. It might only be a temporary fix. Benjamin Fanjoy/Getty Images Keep calm: We have a plan.That's essentially been the adtech industry's response to Apple's latest crackdown on web trackers.The workaround may only be a temporary fix, however.Apple recently implemented new restrictions in its Safari browser designed to stamp out "identity resolution," a method used to track users across different devices and websites by linking data points such as IP addresses, email addresses, and other identifying information collected about them.Adtech has largely united around a proposed solution: Move the identity resolution process so it takes place inside publishers' and adtech companies' servers rather than in the browser, where Apple has more control. Adtech industry execs have said the move will mitigate disruptions to publishers' revenue and measurement from Apple's blockers, while still allowing them to respect users' privacy choices.Privacy experts, on the other hand, say that while the server-side shift might succeed temporarily, it's far from a permanent solution. Apple has made it clear that attempts to circumvent its tracking protections could trigger further restrictions on adtech companies."It's tough to predict how long Apple would need to find ways to block workarounds, but adtech companies that bet against the browser are in for a rude awakening at some point in the future," said Zach Edwards, a cybersecurity researcher and cofounder of the adtech transparency platform DecryptAds.The stakes extend beyond the adtech companies whose technology Apple is blocking. Publishers and advertisers have increasingly relied on identity resolution to target specific audiences and to measure whether campaigns are working. If identity resolution becomes less effective, advertisers could shift more of their budgets away from web publishers and to platforms like Google and Meta that have reams of their own logged-in user data.Anthony Katsur, CEO of the IAB's Tech Lab, which created the Trusted Server project, said its estimates show that the Apple-powered browser ecosystem accounts for 40% of total web traffic, which leaves a large chunk of potentially unaddressable ad inventory. "That creates tremendous downside for media companies to then prove themselves to agencies and brands they work with that, yes, a consumer saw this ad, and they converted," Katsur said.How Apple could thwart adtech's server-side solutionHow could Apple block identity resolution if the data matching occurs only on servers outside its control?There is a precedent. When Apple blocked third-party tracking cookies in Safari, some adtech companies used a workaround called CNAME cloaking. It made third-party trackers appear to Safari as if they belonged to the website a reader had chosen to visit — known as "first-party" activity. Apple soon identified and developed protections against that tactic.Edwards said many server-side tracking systems still rely on cookies or other identifiers stored in a user's browser to recognize them across websites. Apple can block the collection of identifying information before it reaches the server.Privacy-focused browser company Brave, for example, already blocks scripts that are known to collect and record information used for server-side identification, said Pete Snyder, the company's principal researcher.Katsur of the IAB Tech Lab said the switch to server-side isn't an attempt to trick the browser."This isn't about circumventing consumer privacy preferences; this isn't about circumventing regulations; it's about moving the advertising stack to a publisher-controlled server-side solution that complies with legal regulations," Katsur said.He added that through the Trusted Server, publishers can also strip out unwanted third-party tracking identifiers from ads.Katsur acknowledged Apple was likely to clamp down on server-side identity resolution eventually, but that the tech giant risks breaking essential web functionality if it goes too far.The consumer opt-out optionSome server-side matching may be impossible for Apple to stop through browser technology alone. If someone provides their home address to an e-commerce site for delivery of their purchase, Apple's Safari can't prevent the retailer from knowing it. The retailer could then potentially use that information to match the customer against other databases.Snyder said it's why Brave supports consumer opt-out mechanisms like the Global Privacy Control signal, a browser setting that tells a website a user doesn't want their data sold to or shared with third parties for targeted advertising, a preference companies must honor where the law requires it. Starting January 1 next year, the state of California will require browsers to provide an easy-to-find setting that lets users opt out of having their personal data sold or shared."Protecting users against this kind of tracking requires 'privacy in depth,' or using a wide range of privacy protections, by default and automatically, to minimize how often users share identifiers, and to, whenever possible, block sites trying to collect those identifiers," Brave's Snyder said.Moving identity resolution to servers may temporarily put the method out of Safari's current reach, but not necessarily out of Apple's sights."This is basically a cat-and-mouse game, but the cat in this instance is a trillion-dollar company controlling one of the most valuable user data supply chains in the world," Decrypt Ads' Edwards said. Read next Business Insider tells the innovative stories you want to know Business Insider tells the innovative stories you want to know Business Insider tells the innovative stories you want to know Business Insider tells the innovative stories you want to know Lara O'Reilly is the anchor of the CMO Insider newsletter.She is a chief correspondent who has covered the digital advertising, marketing, and media industries since 2010. Her current beat includes big tech companies like Alphabet and Meta, adtech firms, agencies, publishers, the creator economy, and CMOs.Lara has previously worked as a reporter and executive producer at titles including The Wall Street Journal, Digiday, Yahoo Finance, and Marketing Week. She was previously Business Insider's senior global advertising editor from 2014 to 2017.Lara is a regular guest on TV and radio and has appeared on outlets such as the BBC, NPR, SiriusXM's Wharton Business Daily, and CTV Television Network. She also frequently speaks on stage at major events such as Web Summit, IFA, VivaTech, Advertising Week, and Cannes Lions.To get in touch with Lara O'Reilly, email loreilly@businessinsider.com or contact her on Signal at @loreilly.71 Apple