IDFA changes on iOS 14

During WWDC20, Apple announced a new version of iOS that will be officially released on September 18 of 2020.

This new version, iOS 14, introduces some changes Apple believes will help end-users understand how an app might use the end-user's personal information. These changes will affect Mixpanel in a relatively inconvenient way and are worth discussing in this post.

Particularly, Apple will require end-user consent (provided via an opt-in) before an app developer can access the iOS advertising identifier (or IDFA). The IDFA uniquely identifies each end-user device across multiple apps. Additionally, developers will also need to answer a questionnaire about what kind of data they collect and how it's used when the app is uploaded to App Store Connect.

Advertising identifier (IDFA or IFA)

What is IDFA?

It's a randomly generated string that identifies a device. It's mainly used to track a user across multiple apps. Nowadays, its primary use case is for advertisers; ad networks rely on IDFA values for multiple reasons such as ad re-targeting, campaign analysis, and data enrichment.

What will change?

After iOS 14 is released, accessing the IDFA value will require an app developer to obtain an end-user's consent via a modal window, similar to the dialogs users see when an app requests push notifications or location services. All apps will now need to obtain permission to access this unique identifier:

There will be a new setting configuration in every device where a user can disallow any apps to prompt that window modal. Under some circumstances, this setting is disabled globally, and no apps on that device will be allowed to request this permission (e.g. profiles for users under the age of 16).

Apple asks developers to request this permission every time the app is launched and encourages programmers not to cache the IDFA.

How does Mixpanel use the IDFA nowadays?

• Mixpanel identifies all events and user profiles with a UUID; we call the UUID distinct_id or $distinct_id. In iOS, Mixpanel does use the IDFA string as $distinct_id in some cases.

  Since the IDFA might not be always available in the device (e.g. AdSupport framework is not installed), the Mixpanel iOS SDKs (Swift and Objective-C) will default to other types of unique IDs. Furthermore, developers can already choose not to use the IDFA with Mixpanel even if it's available.

  We chose the IDFA string as the default UUID value because it allows our customers with multiple apps to analyze their customers behaviors across those applications more easily. Every decision in software engineering comes with a set of trade-offs, which is why we allow our customers to change this behavior.

• Mixpanel also stores the IDFA/IFA as a user profile property $ios_ifa so even if the user has been identified with a different ID (e.g. e-mail), the value of the IDFA is kept in their project to make user de-duplication and merging easier.

Impact after iOS 14 on Mixpanel

The impact is marginal. While some customers using the IDFA will be inconvenienced by this change - we have prepared a guide (below) to help affected customers seamlessly migrate. Mixpanel already works under the assumption that the IDFA might not exist, however, it's important to keep in mind that our analysis is independent from this parameter.

To help customers navigate throughout the migration, there are two things we will be focusing on:

• IDFA on SDKs. We will stop using IDFA in the iOS SDKs (parity with Android since we don't use GAID either). Even if it is available, it imposes some challenges for us like caching, permissions and usage of new frameworks and doesn't add a lot of value. We will default to a random generated unique ID, like Android does. With the new SDK update (coming soon) you won’t need to do anything. If you want to stop using the IDFA already without updating the SDK you can already use our MIXPANEL_RANDOM_DISTINCT_ID pre-processor macro. Default property $ios_ifa won't be collected either. See pull requests for Objective-C and Swift.

• Customers can always set/identify the distinct_id or $ios_ifa property by themselves if they have access to the advertising identifier using our set method or identify method.

• Integrations. While we haven't built any integration that relies on the IDFA, some partners do mention that attribute in their docs. They do not enforce using the advertising identifier with Mixpanel, but we will work with them to make sure customers understand the IDFA is not a requirement (i.e. update their docs).

Why is Apple making this change now?

Apple's spent the last several years advancing itself as a privacy-focused company. In keeping with that focus, Apple is following a global trend aimed at requiring two things: (i) just-in-time notices and (ii) opt-in consent.

1. Just-in-Time Notices. A product of the GDPR's privacy by design and notice requirements, just-in-time notices (like those shown above) alert end-users to data collection at the moment of collection. Such notices are very popular with regulators because they suggest end-users are being informed about data collection. By using just-in-time notices, Apple is embracing this trend (and leveraging their natural advantage as a platform provider).
2. Opt-In Consent. Apple's proposed requirements are very similar to the "cookie regulations" common in Europe. Those requirements limit how website and app operators can collect information from end-users without opt-in consent. As noted above, Apple is embracing the trend for requiring opt-in consent for certain tracking.

Mixpanel share's Apple commitment to privacy and applauds its attempt at transparency. Like Apple, Mixpanel is not in the business of monetizing personal information. Instead, we allow our customers to understand end-user behavior so they can make better products.

Data collection questionnaire

There is not much information on this item besides what was explained during this session.

With iOS 14, when a new app is submitted to App Store there will be a questionnaire that the app creator will need to answer:

While the questionnaire is not public yet, it seems that you need to specify what data is used to track someone across external apps and websites, which in our case is none. We only allow customers to track data they own; data sent to Mixpanel is not used by any other external companies. While we do not expect that a developer will need to check anything on the questionnaire because of Mixpanel, we will keep a close look during the coming weeks.

If you have any questions or concerns, feel free to drop a comment below and someone from our team will answer as soon as possible.