再见追踪？iOS应用程序跟踪透明度和隐私标签的影响
Goodbye Tracking? Impact of iOS App Tracking Transparency and Privacy Labels
摘要：
跟踪是一种高度侵犯隐私的数据汇集做法，多年来在移动应用程序中无处不在，因为它支持基于广告的收入模式。作为回应，苹果在iOS 14中引入了两项重大变化：应用程序跟踪透明度（ATT），这是一个强制性的选择加入系统，用于在iOS上启用跟踪，以及隐私营养标签，它披露了每个应用程序处理的数据类型。到目前为止，这些变化对个人隐私和控制的影响还没有得到很好的理解。本文通过分析来自英国App Store的1，759个iOS应用程序的两个版本来解决这一差距：一个版本来自iOS 14之前，另一个版本已更新以符合新规则。我们发现，苹果的新政策正如承诺的那样，阻止了广告商标识符（IDFA）的收集，这是一个跨应用跟踪的标识符。从事侵入性数据行为的小型数据代理商现在将在跟踪用户方面面临更大的挑战-这对隐私来说是一个积极的发展。然而，在研究的应用程序中，跟踪库的数量大致保持不变。许多应用程序仍然收集设备信息，可用于在组级别跟踪用户（队列跟踪）或以概率方式识别个人（指纹识别）。我们发现应用程序通过使用服务器端代码计算并同意指纹派生的标识符的真实证据，从而违反了Apple的政策。我们发现，苹果公司本身也参与了某种形式的跟踪，并豁免了第一方跟踪和信用评分等侵入性数据做法。我们还发现，新的隐私营养标签有时不准确和误导。总的来说，我们的研究结果表明，虽然现在跟踪个人用户更加困难，但这些变化加强了看门人公司现有的市场力量，这些公司可以获得大量的第一方数据，并激发了反作用力。
英文摘要：
Tracking is a highly privacy-invasive data collection practice that has been ubiquitous in mobile apps for many years due to its role in supporting advertising-based revenue models. In response, Apple introduced two significant changes with iOS 14: App Tracking Transparency (ATT), a mandatory opt-in system for enabling tracking on iOS, and Privacy Nutrition Labels, which disclose what kinds of data each app processes. So far, the impact of these changes on individual privacy and control has not been well understood. This paper addresses this gap by analysing two versions of 1,759 iOS apps from the UK App Store: one version from before iOS 14 and one that has been updated to comply with the new rules. We find that Apple's new policies, as promised, prevent the collection of the Identifier for Advertisers (IDFA), an identifier for cross-app tracking. Smaller data brokers that engage in invasive data practices will now face higher challenges in tracking users - a positive development for privacy. However, the number of tracking libraries has roughly stayed the same in the studied apps. Many apps still collect device information that can be used to track users at a group level (cohort tracking) or identify individuals probabilistically (fingerprinting). We find real-world evidence of apps computing and agreeing on a fingerprinting-derived identifier through the use of server-side code, thereby violating Apple's policies. We find that Apple itself engages in some forms of tracking and exempts invasive data practices like first-party tracking and credit scoring. We also find that the new Privacy Nutrition Labels are sometimes inaccurate and misleading. Overall, our findings suggest that, while tracking individual users is more difficult now, the changes reinforce existing market power of gatekeeper companies with access to large troves of first-party data and motivate a countermovement.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
