Concerns in the media industry regarding Apple’s adoption of Intelligent Tracking Prevention (ITP) have recently been growing, with talk about the death of the cookie. The release of version two of ITP, which is even more strict, has ramped up the fearmongering. The fear is that this will prevent vendors from being able to track users online, which will subsequently hurt the ability to programmatically retarget them.
If ITP works as well as its creators wish, it will essentially mean the end of the programmatic industry as we know it. Bye-bye, DMPs and audience targeting.
It’s worth noting that those who work within the data/technical side of the industry aren’t particularly concerned that their entire business models could soon be dead. Do they know something the rest of us don’t? A more careful look at how ITP actually works might provide some real answers.
The most significant release is ITP 2.0 and details of how it works can be found on the WebKit blog. For those of you who are unfamiliar with WebKit, it is the open-source engine behind Safari and other browsers; even Chrome is partly based on a fork of WebKit.
Before we delve into how ITP works, it’s worth going over how tracking works at a high level. Pixel trackers and third-party iframes are the most common methods used to track users across the web. Let’s say you visit news-site.com, which amongst the hundreds of resources that it loads, also loads a pixel from tracker.com. A cookie is attached to tracker.com, which is stored in your browser. If you then visit blog-site.com, which also loads a pixel from tracker.com, the same cookie is transmitted to tracker.com’s server and is then able to work out that you visited both news-site.com and blog-site.com. The same mechanism works with third-party iframes; the Facebook like button is such an example and is how Facebook knows all about your online activities even outside Facebook.
ITP attempts to prevent this cross-site tracking ability by preventing cookies from being set and transmitted without specific user permission from domains known for tracking. However, the key here is to know which domains are used for tracking and which are not. Simply blocking all third-party cookies would wreck the user experience on a majority of websites, as they are integral to providing important features such as social logins and even online payments.
WebKit must’ve realized that it would be impossible to create and maintain a list of all known tracking domains. They therefore decided to use machine learning to classify domains. Importantly, this happens on the device and is where the fundamental weakness lies. All machine learning systems have to be trained with data that then allows the algorithm to “learn” and apply this learning to new data.
The quantity and quality of data provided are fundamental to the capability of the AI as more and better-quality inputs result in better AI behavior. This is why Siri’s ability to learn is not based on the device. It instead sends all data back home to where the AI can constantly learn, thereby improving the user experience for all users. ITP’s ability to learn will therefore be limited and will not be able to learn to be able to cope with the changes in how trackers work.
The algorithm does already take into account sophisticated tracking methods, such as redirects where tracker-1.com points to tracker-2.com, which then goes to tracker-3.com. Tracker collusion is even more sophisticated where multiple seemingly independent trackers collude to work out a user’s browsing history and activities.
The scope to increase the number of tracking domains and collusion on the client- and server-side provides a variety of options for sites looking to track users to fool the AI. Currently, trackers are not trying particularly hard to mask their activities from ITP, but if there’s an arm’s race, I believe vendors who track users will prevail over ITP’s ability to shut them down.
As a final thought, even if ITP does somehow prevail, the sad fact is that it will probably only affect the smaller players in the media ecosystem. Google and Facebook will continue to track users across the web because of social logins that have proliferated. It’s so useful to most people that even Apple won’t dare prevent this functionality.
