Apple’s Safari to Facebook’s Like and Share buttons: Dislike

The next version of Apple’s Safari browser will break a lot of buttons around the Web, with Facebook’s advertising strategy leading the collateral damage.

Almost two hours into the keynote opening Apple’s Worldwide Developer Conference on Monday, Craig Federighi, Apple’s senior vice president of software engineering, explained how the mobile and desktop versions of Safari would expand the Intelligent Tracking Prevention Apple added last year to shield users from tracking related to the Like and Share buttons of Facebook and other social networks, as well as comment systems based on them.

“These can be used to track you, whether you click on them or not,” Federighi told the 6,000-odd Apple developers gathered at San Jose’s McEnery Convention Center. “And so this year, we are shutting that down.”

Why you might not like a Like button

When Facebook users see ads on the social network target them with spooky accuracy, their immediate reaction is often to worry that Facebook’s mobile apps surreptitiously listen to their conversations, something Facebook denies.

What they may not realize—and what Apple, with its expansion of Intelligent Tracking Prevention, is shining a bright light on—is that Like and Share buttons, along with Facebook-powered comments systems, let Facebook observe user activity at those sites, even if the users never interact with those Facebook outcrops. (Disclosure: One of my clients, USA Today, employs Facebook comments.)

These Facebook buttons (and similar interactive widgets from Twitter, LinkedIn, Google, and other companies) have since grown past ubiquity to become background noise.

Some readers objected when news sites began deploying extensions of the social network. After The Washington Post added Facebook social plug-ins in 2010, for example, my then-employer had to scramble to add an opt-out button.

Facebook’s ad settings similarly let you opt out of having your activity tracked at other sites, but it’s easy to overlook them among all the other privacy options governing how it amasses your data.

Apple takes a big step farther

Intelligent Tracking Prevention “2.0,” coming in Safari 12 when it ships this fall in macOS Mojave and iOS 12, is far more rigorous than Safari’s first implementation of ITP, which allowed Like button lurking.

As a post on the WebKit developer blog explains, ITP 2.0 no longer lets any tracking cookies, as classified by a machine-learning algorithm on individual devices, persist. Safari 12 will let the user allow or veto cookies with a click or tap response to a browser prompt.

In a slide shown demonstrating the prompt behind Apple’s Federighi at WWDC, a dialog box at a music news site asked, “Do you want to allow ‘facebook.com’ to use cookies and website data while browsing ‘blabbermouth.net’? This will allow ‘facebook.com’ to track your activity.”

In essence, Apple has taken a strict implementation of the opt-in logic of the European Union’s General Data Protection Regulation and made it a default setting.

That may not have much of an effect on desktop-based Web access, where NetApplications’ May 2018 browser share data put Safari in fourth place, with only 3.71 percent of user sessions at sites that the company monitors. But it could have a significant influence on mobile Web access, where Safari accounts for 26.7 percent of phone-browsing sessions, second after Google Chrome’s 63.6 percent, and 47.98 percent of tablet-browsing sessions, first in that category.

Safari’s share of the mobile-browser market alone could drastically cut back on the ability of Facebook, as well as Google, to see what users do at third-party sites—dulling the accuracy of their ads and therefore eroding the rates they can charge.

Among Safari’s competition, only Mozilla Firefox offers a comparable Like button-blocking feature, based on the San Francisco-based service Disconnect’s blocklist. But that’s not on by default.

“I believe Safari’s blocking of the Like/Share buttons of Facebook and other social media will certainly make a dent in their ad-tracking models, but how big a dent is hard to say,” Ann Cavoukian, expert-in-residence at the Privacy by Design Centre of Excellence at Toronto’s Ryerson University, wrote in an email. She compared it with the GDPR’s “strong raising of the privacy bar.“

Now what?

As of Tuesday afternoon, Facebook had not answered a request for comment. Alex Stamos, Facebook’s chief information security officer, offered his own take on Apple’s move in a tweet to Cheddar reporter Alex Heath: “If this is about protecting privacy, and not just cute virtue signaling, then they should block all 3rd party JS [JavaScript] and pixels.”

Stamos, a frequent participant in Twitter debates about online privacy, followed up by suggesting that reporters ask “if this provider of a default browser (which can’t really be replaced on iOS) is going to apply such enhancements fairly across the Web.”

The Interactive Advertising Bureau, a New York-based advertising-industry group, appears to be less amused than Stamos.

“Apple’s unilateral and heavy-handed approach takes choice out of consumers’ hands, and is bad for ad-supported online content and services we all enjoy,” Dave Grimaldi, public-policy executive vice president at the IAB, said in an e-mailed statement.

Apple professes that it isn’t trying to disconnect the online-ad business.

“We don’t believe there’s anything wrong with digital advertising,” CEO Tim Cook told NPR’s Steve Inskeep in a Tuesday interview. Instead, Cook said, Apple wants to stop companies from “tracking you in places where you don’t reasonably expect to be tracked.”

Casey Oppenheim, Disconnect co-founder and CEO, noted in an e-mail that Apple has not only been making privacy a core feature of its traditional products—it’s also trying to build its own online content and services business.

“The move to block Facebook widgets serves both of these goals by giving Safari users a heads-up about unexpected tracking, and by creating more friction and fear on news sites that embed Google and Facebook,” he wrote.

Apple might respond, Oppenheim said, by offering “an alternative-ad ecosystem that respects user privacy,” or it could push subscriptions to its Apple News apps, something Bloomberg News reported in April it is preparing to do.

Adding a new bill from Apple to your monthly expenses might not be the outcome you’d want from Apple’s experiment, but it’s too early to rule that out.