Apple’s Latest Crackdown: Apps Pulling The Advertising Identifier, But Not Showing Ads, Are Being Rejected From App Store

This weekend, Apple began rejecting mobile applications from the App Store which retrieve the end user’s IDFA (Identifier for Advertisers), but don’t show any ads. The IDFA is today the preferred ad tracking option, following the phasing out of the unique identifier known as the UDID. Over the years since Apple first announced its intention to end developers’ reliance on the UDID, due to privacy concerns and a changing regulatory environment, Apple had been pushing app publishers to adopt the IDFA instead.

Throughout 2013, Apple signaled to developers it was time to make the switch by rejecting apps using cookie-tracking methods, and later those using MAC address tracking, for example.

But now that a large number of publishers have moved over to IDFA, Apple is beginning to inform them of how the IDFA can and can’t be used. The clause in particular which Apple is enforcing is 3.3.12:

“You and Your Applications (and any third party with whom you have contracted to serve advertising) may use the Advertising Identifier, and any information obtained through the use of the Advertising Identifier, only for the purpose of serving advertising. If a user resets the Advertising Identifier, then You agree not to combine, correlate, link or otherwise associate, either directly or indirectly, the prior Advertising Identifier and any derived information with the reset Advertising Identifier.”

Tapstream, which reported the rejections’ occurrence on Friday, explains that the IDFA today supports a variety of tracking opportunities beyond advertising, though that is the typical case. Publishers are the only ones who are supposed to access the IDFA, not advertisers, Tapstream says. But because ad networks charge advertisers based on installs that are run by end users, the advertiser passes the identifier to the ad network for tracking purposes.

However, many analytics and optimization services also use this identifier, including Mixpanel. Some apps integrated with Mixpanel are also now being rejected. A full rejection letter, posted here, has Apple telling the app developer that: “We found your app uses the iOS Advertising Identifier but does not include ad functionality. This does not comply with the terms of the iOS Developer Program License Agreement, as required by the App Store Review Guidelines.”

Apple advised the publisher to check code, including third-party libraries, to remove any incidences of the following:

class: ASIdentifierManager
selector: advertisingIdentifier
framework: AdSupport.framework

Mixpanel, fortunately, allows publishers to switch off IDFA option and use a different ID instead.  Others potentially affected include Facebook’s Parse and TestFlight.

Facebook Profile SpyThe reasoning behind Apple’s push to eliminate IDFA usage outside of apps that are actively showing advertising is not entirely clear. Tapstream suggests that Apple is probably reacting to how the IDFA has slid in as the UDID replacement, allowing apps to collect and warehouse IDFAs for a variety of things, ranging from running retargeting campaigns to building user profiles. “These broad tracking and targeting technologies may be seen by Apple as eroding end-user privacy,” notes the blog post.

In addition, by collecting this data, developers are also violating the spirit of the IDFA implementation which was to put more control over app tracking back into the hands of users.

A setting in the current version of Apple’s mobile operating system, for example, allows users to reset a device’s Advertising Identifier at any time. (Settings->Privacy->Advertising->Reset Advertising Identifier). Doing so limits advertisers ability to target you with relevant ads based on your interests. Broadly speaking, it’s similar to wiping out the cookies your web browser has collected and stored.


Others, including those discussing the matter now on Hacker News, are not so sure Apple is only focused on user privacy. Some point out that the move affects the advertising industry heavily, but potentially puts Apple’s iAd in a better position there. Another suspects that Apple is taking a shot at Stripe, Braintree and PayPal who may want to use the IDFA as a part of their scheme to identify users and devices for their mobile payment solutions. Meanwhile, Apple is rumored to also be moving into the area of real-world mobile payments.

Both of these guesses paint Apple in a bad light, pushing back at third parties in favor of its own solutions.

But Apple could also be trying to signal to advertisers that it’s time to shift to a Cost Per Click (CPC) method, rather than CPI (Cost Per Install), says Tapstream – which is worse for advertisers, yes. But app install ads have also been problematic in recent months, with some shady ads appearing that have been automatically redirecting users to the App Store without users first tapping on the ads to launch the App Store. This is a very poor end user experience, and one where the users blame the platform (iOS) and the app running the ads, which is also a victim. There are tools that scan for these types of app install ads but that’s an imperfect solution.

In addition, even the usual app install ads (those that don’t launch automatically) can also be used to game the App Store’s charts by pushing users to download apps, and that, in turn, could artificially boost an app’s ranking. Apple has a long history in fighting back against any techniques used to move apps up into the App Store’s top charts through inorganic means.