Apple has now launched version 2.0 of its Intelligent Tracking Prevention (ITP), the least awaited software update in the eyes of the digital advertising industry since…version 1.0 of Intelligent Tracking Prevention.
Intelligent Tracking Prevention is a setting in the Safari browser available in versions 11 and above. Its purpose is to limit the access web-based tracking solutions have to cookies set on the Safari browser. Its potential impact has dropped a thunderbolt on the online advertising industry. But is ITP ushering in new standards for online tracking or much like the ‘Do Not Track’ initiative, will the pace of technology quickly make it irrelevant?
What does Intelligent Tracking Prevention actually do?
ITP evaluates a web domain’s propensity to track a user when they aren’t aware its happening. The logic underpinning ITP is that cookies set by first-party domains (domains the user actually visits) are a strong indicator that the user is happy and aware of what these domains and their associated cookies are doing. Domains using third-party cookies (set by domains other than the one a user is visiting/seeing in the address bar) are thought to be more at risk of collecting data on a user without their knowledge, normally for the purposes of online ad tracking.
ITP uses an algorithm to identify and ‘partition’ third-party cookies. It gives them a unique storage classification that is attached to the root or top-level domain of the cookie. It originally only allowed the partitioned cookies to exist on a user’s Safari browser for 24 hours.
ITP in its original configuration was bad for online advertising because it limited the ability of online ad tracking, to record the effectiveness of advertising to a shortened, 24 hour window. Here’s a practical example:
When a user visits a publisher’s website they click on a tracking link. The user’s browser redirects to a tracking domain which allows the tracking provider to capture information about the click event, like timestamp and the identity of the publisher. This process will normally see a tracking provider set a cookie using their domain, such as www.network.com. This all happens in a matter of seconds and without the user’s knowledge, before they are directed to the advertiser’s site – www.advertiser.com. This means the cookie set by the tracking domain is read as third-party.
When the user then makes a purchase on the advertiser’s site, a conversion tag will normally be triggered that uses the same tracking domain as the one in the click - www.network.com. The tag will attempt to associate with the cookie, and is doing so in a third-party context. This set-up is sometimes referred to as ‘pixel’ or ‘web-request’ tracking.
ITP 1.0 allowed the cookie from the tracking provider to be read for 24 hours after the click event. So transactions driven by the publisher’s advertising would be limited to a 24 hour attribution window.
What will change in ITP version 2?
ITP’s version 2 update has now been rolled out on iOS 12 and MacOS Mojave.
It will bring about several key changes that will further limit the effectiveness of online ad tracking in Safari. The most high-profile change is:
ITP 2 closes the 24 hour window of use for third-party cookies. This means cookies set by domains acting in a third-party context will no longer be able to be read on Safari version 11 and above. Any tracking companies relying on third-party cookies will no longer be able to track online activity.
However, there are two less heralded updates in ITP2 that may also cause disruption for online tracking companies, even those using more sophisticated or so-called ‘ITP proof’ methods than the standard ‘web request’ tracking described above.
First Party Bounce and Tracker Collusion are two ITP 2 features that aim to prevent a URL invisibly redirecting a user to a domain controlled by a tracking provider. Most tracking companies use some form of redirect URL to send a user to a website, which might record an event before sending the user on to their target domain. Dropping cookies using these invisible domains will be blocked.
Origin-Only referrers is a new feature for ITP 2 that truncates the amount of information tracking companies can capture from referring URLs down to the root domain only. This means companies will not be able to use signals from parameters passed in a referring URL from an advertiser’s website to track events like clicks on advertising links. This is currently a common alternative to setting third-party cookies.
Browsers are taking control of ad-blocking
A few years ago ad-blocking delivered by independent software that plugged into desktop browsers or ran in native ads, like Ad Block Plus, were big news. Growth statistics from the time suggested these ad-blockers would be a staple part of our internet usage by now. Yet the IAB’s study into ad-blocker use in 2018 showed that the number of internet users with an ad blocker installed is now constant at 25%, and the number of users actively using ad blockers is likely to be significantly lower due to the impact it has had on their ability to use the internet.
The plateauing in use of independent ad-blockers could in part be down to the impact of initiatives like the Coalition For Better Ads. But the importance of ad blocking functionality hasn’t gone away. The mantle has now passed from independent companies to the browser manufacturers themselves, who have heeded the message in the growth of ad-blocking plugins and are now building the same functionality into the browsers we use to access the internet.
Safari deserve credit for making the first move, but Mozilla have also announced a domain-level blocking feature to be released in Firefox 65.
Will the most-used browser of them all, Google Chrome, follow suit? We think it is unlikely given Google’s significant interests in the ad tracking industry, but Google have recognised the general shift away from pixel and redirect tracking by pushing its Google Ads users to use a server-side method to report click events.
What does the future look like for online advertising?
Tracking in the online advertising industry has never felt like a bigger game of cat and mouse. The privacy advocates, who are now actively supported by many major browser manufacturers, are looking to close the net on domains using third-party context to track online. But digital advertising is an eco-system that brings massive benefits to internet users, not least free searching, free tools like analytics and vast amounts of free content.
Safari has circa 18% share of the browser market, so the potential impact of ITP needs to be measured in context of both Safari’s use and considering the other issues that impact online tracking accuracy, particularly on mobile devices, which are more impactful because they exist across all browsers and devices.
ITP 2.0 will undoubtedly have a longer term impact on the online tracking industry, and we think it’s impact will actually be positive because it will raise the general standard of online tracking practices, ensuring the most reputable online advertising networks continue to do business while protecting the interests of users.
Online tracking moves server-side
In ITP’s case the standard will be a move to server-side logging of events likes impressions, clicks and conversions, with an API-based exchange of data between advertiser and provider, which is becoming more common. Setting a web cookie using the target (advertiser) domain to record events has become a common workaround for ITP, but this still generally relies on http/s web requests being triggered from an advertiser’s site to track online, particularly when it comes to conversions.
The age of internet privacy is with us. And the new standard for online tracking is now being laid down by big-hitting browser companies that are steering the agenda first launched by independent ad-blockers. The good news for online tracking providers is the browsers are now laying down a standard that if followed will ensure a robust level of tracking, at least in the short-term.
Demystifying ITP 2.0
If you are a publisher or website owner that generates revenue, you will likely be reliant on online tracking from other companies. It’s therefore vital to understand the impact ITP 2.0 may have on your business.
In this video we show how you can identify domains Safari is marking as third party, and therefore treating differently under ITP 2.0.
Any example domains we have shown in this video as being marked up by ITP do not necessarily mean the tracking services associated with these domains will not work on Safari. It means ITP is likely to prevent them using cookies in a third party context. These tracking services may already be utilising other tracking techniques that allow them to track on Safari, even when ITP is active.
After identifying tracking services that may be treated differently under ITP we recommend discussing with the specific tracking provider to clarify what steps they have taken.
