Earlier this week, Apple announced at it’s WWDC 2018 it will implement new security features to its Safari web browser. One of these new features is the second version of Intelligent Tracking Prevention (ITP), which was first released by Apple in March last year.

It’s still uncertain exactly what the ramification of ITP 2.0 will be, however the first version of ITP had a dramatic impact on the advertising technology industry.

ITP is designed to prevent unwanted third parties from collecting user data without their knowledge. It uses a machine learning model to manage cookies. All data collection and classification happens on-device.

What’s new in ITP 2.0?

No more 24 hour cookie access window

ITP 2.0 immediately partitions cookies it determines to have tracking abilities, removing the 24 hour window after the last website interaction allowed in ITP. Authenticated embeds can get access to their first party cookies through the Storage Access API.

New user prompt

ITP 2.0 adds a prompt to WebKit’s implementation of the Storage Access API. When a user selects ‘Allow’, Safari remembers their choice and blocks access when ‘Don’t allow’ is selected.

ITP 2.0 detects third parties making use of “first party bounce trackers”, purging their website data. 

Apple security engineer John Wilander describes how ITP 2.0 prevents trackers from helping each other identify users (tracker collusion): 

Any third party requests (including analytics and remarketing tags) making use of first party bounce trackers or tracker collusion can be blocked by ITP 2.0.

Even when ITP purges website data, trackers still receive the referrer header. This contains the full page url (e.g. https://example.com/product/baby/strollers/deluxe-stroller-navy-blue), providing valuable data to third parties showing which page the user is currently on.

ITP 2.0 will only send the domain name (e.g. https://example.com) for third party requests to domains that have been classified as possible trackers and have not received user interaction.

With Safari holding 15% of the global browser market, these new measures dramatically limit the tracking ability of marketing technology companies and the advertising industry has responded with complaints that they face unrivalled disruption to their business model.

Specifically, a technique known as device “fingerprinting” (a way of identifying users across different websites and devices without relying on cookie technology) will be rendered almost impossible with the update to ITP. This technique relies on data such as a user’s browser operating system versions and browser add-ins, which Apple’s browsers will now suppress as standard. However these techniques are far from mainstream, so this change is unlikely to significantly disrupt operations for advertisers or ad-tech providers.

Of greater concern will be the changes to the way Apple’s browser handles cookies. In an open letter to Apple, the American Association of Advertising Agencies (4A’s), American Advertising Federation (AAF), Association of National Advertisers (ANA), Data & Marketing Association (DMA), Interactive Advertising Bureau (IAB) and Network Advertising Initiative (NAI) wrote:

 Apple responded by saying:

Apple offer the following guidelines:

Web Analytics

Make sure your web analytics don’t rely on third party cookies from domains with no user interaction. You can still implement cross-site tracking using link decoration, passing information cross-site using url parameters.

Ad attribution

Apple recommend server-side storage for attribution of ad impressions on your website. You can also use link decoration to pass attribution information.