Google reveals significant step to restrict cross-app tracking on Android

Google is set to limit cross-app tracking on Android devices as part of a broader extension of its privacy controls, bringing it more in line with Apple's policies.

The tech giant revealed on Wednesday (February 16) a multi-year initiative to abolish app tracking identifiers and limit the sharing of user data with third parties on Android, in a move it said is designed to improve user privacy in the app ecosystem.

This applies to Android's identifier, Advertising ID, which assigns a unique string of characters to a user's device to allow advertisers to track their activity as they move between apps.

It works in the same way as Apple's IDFA (ID for Advertisers), a randomly generated code that Apple assigns to its devices.

Apple introduced a requirement for app developers to obtain consent from users to collect the unique device code in April last year, to give users more control over their data. Early data indicated that the vast majority (in some estimates over 95%) of iPhone users were opting-out of tracking.

The move has had a significant impact on the ad industry, which has relied on the unbridled ability to track users across apps and devices to measure, attribute and target ads on mobile. It has been especially damaging to tech giants like Facebook owner Meta, which has built its enormous ad business from its extensive data pool and targeting capabilities. Earlier this month, Meta told investors it expects Apple's app tracking shift to cost it more than US$10 billion in lost revenue this year. The revelation caused Meta stock to tumble more than 26%, wiping $230 billion from its market cap.

Google, on the other hand, profited from Apple's IDFA shift. Ad spend from app owners flowed to Android in the first two weeks after Apple launched the privacy feature, according to data from Warc and AppsFlyer. And while Meta's ad business has suffered, Google, which has a rich repository of data collected via its search traffic and YouTube, may have benefited as advertisers shifted their spend. Google's advertising grew 42.5% year-on-year in 2021.

But with growing regulatory scrutiny over its monopolistic practices, Google has little choice but to alter its ad business. 

It has provided scant detail on how it will move away from app tracking identifiers—leading some observers to suggest the announcement appears to be more about appeasing regulators and buying itself some time to figure out how it will protect both user privacy and its ad business.

Google has given advertisers a two-year warning to prepare for any significant changes. During this time, it will continue to support existing ads platform features.

It has rolled out its Privacy Sandbox intiative to Android to develop new privacy-centric ad solutions with the industry. 

As well as replacing identifiers, it said it is also exploring technologies that reduce the potential for covert data collection, including safer ways for apps to integrate with advertising SDKs.

While this long-tail approach will mitigate the impact to advertisers, it nevertheless further intensifies the requirement for the ad industry to develop new solutions and ways of working that protect user privacy.

Google did throw shade at Apple's rather abrupt IDFA move, in which the IPhone maker announced the changes were coming without consulting with the industry on their concerns or working on an alternative.

In a blog post, Anthony Chavez, VP of product management for Android Security and Privacy, wrote that "other platforms have taken a different approach to ads privacy, bluntly restricting existing technologies used by developers and advertisers".

"We believe that—without first providing a privacy-preserving alternative path—such approaches can be ineffective and lead to worse outcomes for user privacy and developer businesses," Chavez wrote.

Google began introducing stricter controls to Advertising ID in June last year to prevent software developers from accessing a user's ID after they had opted-out of personalised ads. Until then, the ID was still being accessed by developers after a user had opted out, to measure app usage or for fraud detection. Google said it would provide an alternate solution to support essential services like analytics and fraud prevention without requiring the unique identifier.

The news form part of an industry-wide push to improve user privacy on the internet after years of tracking a mobile or web user's every move without explicit user consent. The shift to a more privacy-focused internet experience began at a browser level with the elimination of third-party cookies, which will be entirely removed in Chrome by the end of the year.

Google unveiled its latest proposal for a successor to cookies last month, Topics.