What you need to know:

• Apple this week announced another suite of new software features in its next iOS update that it says will enhance privacy for users - but will profoundly impact targeting, tracking and adtech.
• The ACCC warns that industry needs to be careful, keep consumers informed or risk a scandal-fuelled backlash that could see more restrictive legislation around privacy.
• People want their privacy, UM’s Joshua Lowcock says, and the industry has not done enough to manage or contain ‘surveillance capitalism’.
• The Consumer Policy Research Centre’s Lauren Solomon says the cost of personalisation is not transparent. More data means higher the risk of exposure to data breaches, fraud and scams.
• Too much choice can be a bad thing, Pollinate’s Howard Parry-Husbands says. It can confuse the consumer and ultimately be unhelpful.
• Younger users are more used to sharing personal data, and potentially more trusting of marketers, ADMA’s Sarla Fernando says.
• Ultimately, issues with privacy are closely related to issues of antitrust, when it comes to global monopolies like Google and Facebook.

What Apple announced

Apple has dropped privacy bombshells, this week announcing a suite of new software features that will pressure Google, bruise Facebook, disrupt the adtech industry, and diminish hopes of scalable identity-based solutions to the end of third-party cookies.

Less than two months after the rollout of iOS14.5 and App Tracking Transparency (ATT), which required apps to ask permission to track users’ activity across other apps and websites, Apple announced iOS15, which will include:

• Private Relay: Apple will hide user IP addresses by encrypting redirecting Safari web traffic through two servers, as part of its new iCloud Plus service.
• Mail Privacy Protection: In the Mail app, Apple will block invisible pixels that collect information, including IP addresses and even whether someone has opened an email.
• Hide My Mail: Users will be able to set up as many unique, random “burner” email addresses as they like that forward to their personal inbox.
• App Privacy Report: Users can see how often apps access location, photos, camera, microphone and contacts over the previous seven days, and see where data is being shared with third-parties.

“Today, privacy is more important than ever,” Craig Federighi, Apple’s Senior Vice President of Software Engineering, told the company’s Worldwide Developers Conference on Monday.

“Because when you use the internet and third-party apps, you can be tracked by a complex ecosystem of data brokers and ad tech firms, often without your permission. We don’t think this is right.”

Privacy has become a core component of Apple's market differentiation. But do users care? 

Privacy and/or personalisation

Ask Rod Sims about the massive gap between public and industry opinion on data collection and sharing, and he will warn there is a reckoning coming.

If companies that collect data aren’t careful, a scandal could prompt massive consumer backlash and equally swift and potentially disproportionate government reaction.

“It’s much better to have laws made in a sensible environment than a knee-jerk one,” Sims, chair of the Australian Competition and Consumer Commission, says.

“If something came out, people said ‘oh gosh, I didn’t realise this was happening’, all of a sudden there is a groundswell. And government might act accordingly.”

Yet do people really care as much as they say they do? On the one hand, consumer surveys overwhelmingly show the Australian public wants a high degree of privacy:

• 94 per cent of consumers are uncomfortable with how their personal information is collected and shared online – but 88 per cent don’t have a clear understanding of how their information is being collected and shared (CPRC Data and Technology Consumer Survey 2020).
• 90 per cent of users believe platforms should allow them to opt out of collecting certain types of information, and 85 percent believe platforms should only collect information needed to provide their products or services (ACCC consumer survey).
• 85 per cent of Apple users worldwide have opted out of App Tracking, according to Flurry figures (though there are some questions about the accuracy of their data).

If all of that data and polling is correct, then the entire targeted marketing industry would disappear overnight, if users could vote on it.

Apple appears to believe what people say, and has made it a key selling point services. Its latest ad promotes Apple Tracking Transparency at the expense of notorious trackers. By happy coincidence, Apple's privacy pivot also happens to wedge Facebook.

And there are many who agree. Professional ad contrarian Bob Hoffman says it is "ugly and horrifying" that the global adtech industry holds 72 million data points on the average child by the time they reach the age of 13, according to the New Economics Foundation. 

And this from an industry barely out of its teens.

Yet on the other hand, few users actively disengage from Google, Facebook and every other data-harvesting app, website, credit, store card and whatever else. 

Meanwhile, many in the marketing industry are adamant users want personalisation. About 96 per cent of Australians use Google, more than 80 per cent use Facebook, and about half use Instagram, the ACCC says. 

The most established privacy-focused web browser, DuckDuckGo, has less than a one per cent share. While secure messaging app Signal received a notable surge in users after a WhatsApp privacy policy update last December, it currently has around 40 million active users globally. In the context of WhatsApp's 2 billion users, little more than a rounding error. 

The paradox of choice

“Where is the outrage?” Howard Parry-Husbands, CEO of Pollinate, a strategic research consultancy, says. There are no protests, marches or large-scale demonstrations demanding consumer privacy, he said, adding: “The services work incredibly well.”

“Digital platforms work. They offer the consumer a good product, at no cost,” he suggests.

Choice, Parry-Husbands says, is not necessarily a good thing for the consumer. After a certain point, too much choice becomes meaningless, then it becomes counterproductive.

“[Consumers] want everything, they want it to be amazing – and it is – but they want it to be private and secure,” he said.

“If it’s about data integrity, data privacy, there’s a paradox here and the paradox is not solvable.”

The public’s acceptance of – yet disdain for – data collection is baffling, believes Sarla Fernando, regulatory lead at the Association for Data-driven Marketing and Advertising (ADMA).

“We’re aware of privacy rights and how marketers track us, but on the other hand we share it freely and still accept terms and conditions we possibly will never read,” she says.

“We’re torn between the divide to receive personalised content that is saving us time and natural instinct toward privacy rights we believe we have.”

She adds the paradox is partly generational. Younger users born into the internet age are less wary of sharing personal information.

“We’ve got this adrenaline of affirmation, where we can post and share things. It’s second nature for [younger people] to share everything, whereas people who’ve been on a longer journey, they’re a bit more protective, cynical about what will people try and take from them. The younger generation believe marketers will try and do the right thing.

“Today I’m happy for Apple to track my steps on an Apple Watch, but tomorrow should I be concerned if my health insurance premium goes up? If it works in my favour, I’m happy.”

Yet the converse is also true.

Informed consent

The privacy conundrum goes to the heart of incoming regulation. The Federal Government is reviewing submissions to its review of the Privacy Act, the ACCC is reviewing submissions to its digital advertising services inquiry – due to submit its final report in late August, and there are several ongoing court cases involving the ACCC or the Australian Information Commissioner that directly relate to privacy laws or Australian Consumer Law.

Informed consent is another common challenge. While Apple appears to be making some headway following its iOS14.5 update, which requires very simple, explicit wording around tracking consent, it is very much the exception. Most people probably have no real idea of the extent of the industry that has been built upon personal data collection and trading – and that's a potentially existential problem.

“Our surveys show when we describe to people what actually happens, they say, ‘oh no, you can’t let that happen, that would be dreadful’,” says ACCC chair Rod Sims.

“There’s still a huge gulf between people’s understanding of what’s going on, and what they might be seen to be agreeing to… Industry has really got to engage in these debates so we don’t get a backlash which could really close down the data economy.”

Lauren Solomon is the CEO of the Consumer Policy Research Centre, a Victorian government-funded independent think-tank. Every year, CPRC releases a Data and Technology Consumer Survey, which has been an important metric in the ACCC’s inquiries.

“What our research shows is that consumers do value their privacy, but they don’t feel like they have a genuine choice when it comes to what companies collect and share about them,” says Solomon.

She offers a counterpoint to those that claim the platforms offer a good service for free.

“The cost of personalisation is also not transparent. For example, the more data that is shared and matched about consumers, the higher the risk of exposure to data breaches, fraud and scams. Data shared today can impact consumers for years to come. 

“Clearly, there needs to be balance. Consumers expect to be treated fairly, for their personal information to be kept safe and secure, and to have more control.”

Targeting without tracking

All over the world, jurisdictions are grappling with regulatory data challenges that cross borders. Europe’s Global Data Protection Regulation, California’s Consumer Privacy Act and even China’s Cyberspace Administration have enforced varieties of data privacy law.

China has even gone as far as calling out ByteDance, the owner of TikTok, and LinkedIn for illegal collection and use of data. Chinese authorities named and shamed 105 companies for collecting what it called “excessive” user data that was unrelated to their core services.

A weather app might need your location, UM’s Chief Digital and Innovation Officer Joshua Lowcock, says. But users will rightly question whether it needs your name, age, date of birth and email address.

“I categorically believe people want their data and privacy protected,” says Lowcock. “The industry has more work to do around transparent data collection and use. We have not done nearly enough to stem, manage or contain ‘surveillance capitalism.’

“People will complain about bad ads – no-one stops watching content because of bad ads. We need to remember that people consume content for the content.”

Ad contrarian, Bob Hoffman, is characteristically blunt in his assessment.

"The ongoing effort to conflate tracking with advertising is a shameful and deceitful fraud on the part of the advertising trade bodies and their overfed overlords in the holding companies and media platforms," he wrote.

"Advertising does not rely on tracking. TV, radio, newsprint, magazines have been successful for decades without tracking. There is no need for online advertising to spy on the populace to be a viable advertising medium. Once again... is advertising essential to a free web? Yes. Is tracking? No."

Regulators seem to agree with Hoffman and are mobilising – with Australia at the vanguard.

“People have to understand, in my view, our privacy laws aren’t up to dealing with the current data economy we’ve got,” says ACCC Chair, Rod Sims.

“If we want to make sure that consumers don’t lose faith in the data economy, people should get behind some sensible changes to the Privacy Act.”

An up-to-date legislative framework for data, privacy and online consumer law may be harder to pass and maintain than it sounds, however.

Pollinate's Howard Parry-Husbands thinks industry and the platforms will continue to run rings around regulators and lawmakers.

“We have a parliament that sits for 70 days a year,” Howard Parry-Husbands says. “They haven’t managed to pass any policy on a whole host of things for a long time – climate change, for example.

“It’s not possible to keep up. The ability to write and pass policy, manage it and govern it, the process is too long. It might take three or four years to come up with something. TikTok wasn’t around in Australia three years ago.”

What next?

Progress on the limits to data collection, and how that impacts personal privacy, are inherently tied to competition and antitrust laws, says UM's Joshua Lowcock. It’s nearly impossible for a user to shun Google and Facebook completely, which makes it almost impossible to protest their actions.

“You can’t address privacy issues without addressing antitrust. Until you reconcile competition concerns with privacy regulation, we’re not really going to find a path forward that will reform the industry,” he says.

“It’s often said ‘if people don’t want to share data, they can opt out or not use our services’. But this assumes there is always choice. Try applying for a job without an email address, phone number or social media account. The reality is that it’s not a choice in the modern economy to opt out of certain digital services.”

With a third party cookie-less future looming, regulators need to move quickly enough to keep up with what is inappropriate use of data – for discriminatory or predatory behaviour, adds Lowcock.

Parry-Husbands partially agrees. “What we’re seeing is the emergence of more resilient monopolies. Google is now a word. No-one cares about Bing. If someone can come up with a bigger or better search engine than Google, then do it.”

But he and ADMA's Sarla Fernando suggest that privacy and personalisation can co-exist.

“I don’t think it is a personalisation or privacy world,” says  Fernando. “It’s how, in a privacy-first world, does personalisation best work? It’s a debate without a right answer.”

Parry-Husbands: “It is not privacy versus personalisation, it’s what degree of privacy and personalisation is a comfortable mix.”

Over the course of this year – and probably for the foreseeable future – we'll see just how far lawmakers and regulators are inclined to agree.