Be wary when Big Tech says it’s defending your privacy

But don’t be fooled. Apple, Google, and Facebook are picking their privacy battles carefully. These companies aren’t changing how they use or collect our data, only how others do. Yes, these protections are good for us, but they also entrench and expand the power of these already dominant companies. For the tech giants, embracing privacy isn’t just a way to gain public trust and get good press — it’s also a great excuse to toss boulders at one another and squash the startups (and potential future rivals) that get stuck in the middle.

Consider Apple’s upcoming ad privacy update. Sometime this spring, every iPhone app that shows ads or sells data to advertisers will be required to show a pop-up that says, “[This app] would like permission to track you across apps and websites owned by other companies.” You’ll be able to choose between “Allow Tracking” or “Ask App Not to Track.” This will determine whether or not advertisers can access a unique identifier tied to your device called the Identifier for Advertisers (IDFA), a previously hidden linchpin of the mobile advertising industry. It’s hard to imagine many users choosing to allow tracking.

On its face, Apple’s latest privacy protection is a praiseworthy step and a boon for iPhone owners. Mobile advertisers are calling it the first horseman of the “ad apocalypse.” It will give people more control over their data, disempower data brokers that buy and sell information about us, and make it more difficult for pernicious advertisers to track people between apps.

As it happens, the change also will undermine the business model of privacy’s apparent arch-nemesis, Facebook, which makes more than 90 percent of its revenue through mobile advertising. In response, Facebook has launched a public relations campaign that claims Apple’s update threatens coffee shops, florists, and other small businesses that depend on effective mobile advertising.

Facebook’s claims about the impact on small businesses are misleading, but it’s true that Apple’s new ad policy is not mere beneficence. It is particularly designed to undercut the effectiveness of one type of advertising — ads for new apps — in order to help Apple regain control over which apps get popular and how.

About a decade ago, when “There’s an app for that” was on everyone’s lips, the App Store was the main hub where iPhone owners discovered new apps. Being featured on the front page of the App Store could easily get a new app thousands of downloads and all but secure a startup’s next round of funding. But the App Store front page could feature only so many new apps, and in the 2010s, Facebook became the new go-to place for app discovery, this time through advertising.

The IDFA — the Identifier for Advertisers that Apple will soon make easier to block — is a key factor in Facebook’s domination of the world of mobile ads. The IDFA lets Facebook track users from the moment they click on an ad for an app (whether that ad is on one of Facebook’s own services or one of its partners’, such as TikTok or Tinder) to the first time they use that app to make a purchase. These ads are no mere roadside billboards — they are hyper-targeted with personal data and, thanks to the tracking enabled by the IDFA, can offer proof that they work.

By allowing iPhone users to block the IDFA, Apple is throwing a wrench into Facebook’s advertising machine. App developers who want to know how their ads are doing will need to switch to a new advertising technology run by Apple, one that is more privacy-friendly but less targeted than Facebook’s version. In this way, Apple is hoping to reclaim its spot as kingpin of the app economy, as people discover new apps not through Facebook but through the App Store, Siri, and potentially the search engine Apple is rumored to be developing.

Facebook is threatening a retaliatory antitrust lawsuit against Apple, despite the fact that only a decade ago Facebook itself pulled a similar trick. In 2011, Facebook was home to a thriving ecosystem of third-party apps that drew swarms of users onto the platform and drastically increased how much time they spent there. Zynga games, such as Farmville and Mafia Wars, accounted for nearly 20 percent of Facebook’s revenue. However, these apps began to suffocate the platform with their constant invites and invasive data collection, and by 2014, Facebook decided to severely reduce such apps’ access to user data, in the name of privacy. The change doomed an advancing army of startups. Zynga in particular felt the pinch — its market value immediately plummeted from almost $15 billion to $3 billion.

This is bait and switch in the name of privacy — and it worsens the monopolization of the tech sector. Big tech platforms like the iPhone and Facebook are what economists call two-sided markets: they help connect one group of people (app developers, advertisers) to another (the public). An empty platform, though, is useless to both sides. So to solve the chicken-and-egg problem, nascent platforms attract one side of the market by letting them play fast and loose with the other side’s data. This kicks off a virtuous cycle — apps attract users, users attract more apps, etc. — and once a platform has ridden it to dominance, it pulls the switch, removing the data access that attracted apps in the first place. Platforms do this under the banner of privacy, but they undercut startups that have grown large enough to become potential competitors.

To be sure, we want to encourage big tech companies to be better with our data, and their latest privacy interventions are steps in that direction. IDFAs power discriminatory advertising and an economy of voracious personal data collection. Facebook’s 2014 privacy update may have killed Farmville, but it also stopped more personal data from flowing to “This Is Your Digital Life,” a personality quiz app whose troves of data ended up in the hands of Cambridge Analytica and were used to target right-wing political ads loaded with disinformation. Similarly, Google Chrome’s forthcoming “privacy sandbox” will protect users from the privacy invasions caused by third-party cookies, which track us all over the Internet.

The problem is that these moves force us to gain privacy at the expense of having a competitive tech sector. Big Tech benefits from this dynamic. For example, Google’s upcoming change will make advertising more difficult for everyone but Google, further entrenching its position as the web’s advertising superpower. And if this dynamic persists, we will see only the kinds of privacy improvements that allow these companies to entrench their power, not ones that address real problems like oversurveillance, political ad targeting, and data-driven discrimination.

The only way to prevent this is for Congress to pass comprehensive privacy legislation. If platforms are no longer able to lure third parties in with the promise of promiscuous data sharing, they won’t face the privacy concerns that give them an excuse to pull that data out from under the companies that have grown to depend on it.

To rein in the powerful platforms that have already accomplished the bait and switch, we need to figure out how to force them to create opportunities for outside competition and innovation without infringing upon privacy. Big Tech won’t do this on its own, and for the law to get the job done, the government will require a more expansive approach to antitrust, one that doesn’t just stop price gouging but also stops market power (and data) from concentrating in the hands of a few companies.

President Biden has laid the groundwork for this by naming to key executive branch positions outspoken critics of Big Tech who hold these beliefs, including antitrust scholars Tim Wu and Lina Khan. They will need to scrutinize industry-sanctioned privacy gains to make sure these don’t squash competition, worsening one problem while seeming to address another.

Whenever a powerful tech company makes a change that seems to protect our privacy, we should not assume that it is doing it out of moral obligation or even for good PR. Apple, Facebook, and Google have all shown they are capable of co-opting the rhetoric of privacy to cloak their power grabs. Big Tech wants us to believe that this is inevitable if we want better privacy — it’s up to us to prove them wrong.

Gabriel Nicholas is a research fellow at the Information Law Institute and the Center for Cybersecurity at New York University. Follow him on Twitter @GabeNicholas.