MagicSolver

iOS 7: The Tracking Changes You Need to Know About

Apple's announcement of iOS 7 during their WWDC 2013 keynote certainly raised some eyebrows regarding the design direction. Whilst it remains to be seen how the new flat interface will be received, there are some important changes to device IDs that were not part of the keynote announcement.


UDIDs
The UDID (Unique Device IDentifier) has been steadily losing ground for device tracking over the past two years, due to privacy concerns. Now, with iOS 7, it looks like it’s gone for good.

In August 2011, Apple quietly deprecated the UDID in the iOS 5 beta. In March 2012, they started to reject apps that transferred the UDID in the clear for tracking (covered by TechCrunch). Apple later made an official announcement that apps using the UDID would be rejected from May 2013. Now, in a final sweep, iOS 7 will remove UDID support even from apps that haven’t been updated.

Buried deep in the Security section of the release notes for the iOS 7 beta, Apple describes how the -[UIDevice uniqueIdentifier] call will now report the hex value of the "ID for Vendor", prefixed by FFFFFFFF (note: this is not the same as the ID for Advertisers or IDFA, so cannot be used for cross-app tracking). It looks like the UDID is gone for good, starting this September.

Source: Apple release notes

MAC Addresses
The other UDID, MAC Addresses saw a rise as an alternative unique device ID as the UDID was phased out. They identify a device just as uniquely, thus have all the same benefits, but also all the associated privacy concerns. With iOS 7, Apple notes that the MAC Address API calls will now return ‘02:00:00:00:00:00’ for all devices, effectively rendering it useless for any app tracking.

Similarly, the ODIN/ODIN-1 tracking method will be gone in iOS 7, as this is built by taking a SHA-1 hash of the MAC Address.

Source: Apple release notes

OpenUDIDs
In the wake of the UDID deprecation announcement of 2011, a multitude of third-party device ID solutions sprung up to address the privacy concerns around the UDID. The OpenUDID, an open source alternative that gets reset when the user uninstalls all OpenUDID apps, quickly gained ground to become leader of these.

However, another line in the iOS 7 beta release notes effectively puts an end to this, stating that +[UIPasteboard pasteboardWithName:create:] will now create pasteboards unique to an application group. The OpenUDID relies on sharing pasteboards (which are very similar to the clipboard on your computer) to keep the same ID across all apps on the device. With iOS 7, Apple is removing this functionality, which means the OpenUDID will no longer be reliable for tracking – and indeed, was deprecated by its main developer immediately following the WWDC 2013 keynote.

Source: Apple release notes

The IDFA or IFA
Apple’s new primary cross-app tracking mechanism, the IDFA (ID For Advertisers) was announced in iOS 6 to replace the UDID. It can be reset at will and users can even set a preference for it to not be used for tracking. It had some issues on launch where some devices updated to iOS 6 over the air sent values of ‘00000000-0000-0000-0000-000000000000’ instead of the actual IDFA (covered in TechCrunch), but this was fixed in future iOS versions.

The IDFA now looks poised to become the de facto device ID tracking solution – mainly because Apple has removed everything else in iOS 7.

Non-native Tracking Methods
As well as the native device ID methods, two other methods were widely used:

• Cookies: where the ad for your app stores an ID in a Safari cookie when a user clicks on it, then the ad network’s SDK retrieves this value on app launch. The app launch has to involve a ‘flash’ or ‘switch’ to Safari, due to how apps are sandboxed from the main device’s browser, which is a poor user experience and Apple has started rejecting apps that do this.

• Fingerprinting: storing some identifying features, such as IP Address, device type and iOS version. This is still possible, as it is outside Apple's control, but not 100% accurate as many devices can share the same IP Address.

What does this all mean for install attribution?
iOS 7 will be rendering most native device ID tracking methods obsolete, except for their own IDFA. Any apps that want to continue to benefit from CPI (Cost Per Install) based app promotion should update as soon as possible to add support for this ID type, if they haven’t already. Fingerprinting is also a viable option, though less accurate, and will continue to be used by many tracking solutions.

Interested in some more information about these changes? Contact your account manager via newsletter@magicsolver.com, and get some guidance on how to prepare for tracking in iOS 7.