How recent email-focused, privacy-centered announcements from Apple and others impact first-party addressability
Key Takeaways
- Apple is using its position as an operating system on phones and other devices to stand in the way of first parties being able to use a person’s email address to achieve many outcomes—not just ad targeting.
- Google is developing a similar feature for Chrome called WebID and the broader web community is actively discussing it in W3C circles.
- The latest announcements from Apple aren’t a surprise.
- Marketers and publishers should take note of the strategic position operating systems and browsers are in to chip away at their direct relationships with customers and potentials.
- There are paths to achieving strong data protections and more predictable privacy while keeping first parties in a position to determine how they want to reach and interact with their customers and potentials.
- Leaning into new privacy, accountability and addressability standards, further hardening them as an industry, then combining them with ecosystem work to date on supply chain and data transparency is a critical piece to giving marketers and publishers choices of when and how to connect on their customers and potentials.
What Happened?
Last week at its annual Worldwide Developers Conference (WWDC), Apple announced several new features to enhance its privacy street cred. Among those announcements are “Hide My Email,” “Mail Privacy Protection,” and “iCloud+ Private Relay.” This post focuses on “Hide My Email.” It is, however, wise to keep the other new Apple features in mind as you consider where operating systems—mobile and otherwise—are clearly headed.
These latest announcements come as Apple runs a mass marketing campaign focused on its privacy bonafides—at least my assumption is that it is mass marketing. For all I know, the Apple campaign could just as well be targeted at my Roku device where I’m signed in with the same email address I use for my Apple ID which is known by Apple as I write this blog post in Chrome on my MacBook Pro and in the Google Docs app on my iPhone. I’m certain I leave digital breadcrumbs about my interest in privacy and data protection online.
Let’s take a closer look at what’s going on:
- I use my email address to log into or sign up for a site or app.
- Apple’s “Hide My Email” feature recognizes that I’m entering my email address into a form, either in an app or a website.
- Apple makes using this functionality easier than not (note the placement of the “Use” and “Cancel” buttons in the following image).
- If I pick “Use” Apple will populate the sign up with the obfuscated email it generated specifically for this site or app.
- This means the site or app owner receives the obfuscated email address, regardless of how the site or app owner intends to use email.
- Apple holds on to my actual email address because it needs it to resolve emails that site or app now tries to send me. It also has my actual email address for Apple ID. Apple is clearly anointing itself as the most trustworthy among first parties.
Let’s now unpack what Apple’s latest announcements mean for marketers and publishers who advertise within Apple’s devices and want to use my email address—which, unless altered, is the same no matter what product I interact with—to produce audience matches, control campaign frequency, measure reach, build or use a marketing segment, and measure some return on investment.
What should marketers and publishers make of Apple’s announcements?
First and foremost, privacy, data protection, and accountability are increasingly important to business growth, not just compliance. If your post third-party cookie strategies do not take this truth into account, you’re going to miss the boat. We’ll come back to this.
Second, Apple’s latest privacy announcements are no surprise. Apple launched “Sign in With Apple” two years ago at WWDC. “Sign in With Apple” is now required for any iOS app that offers people an option to sign in with single sign-on services from Google, Facebook, etc. “Hide My Email,” like “Sign in With Apple,” creates a random, app-specific email so that one app developer cannot connect to another app developers’ audience using a common email address. What’s new here is the broadened scope of use cases where a person’s email address may be obfuscated by Apple. Before it was just in iOS where an app offered a competing single sign-on tool. “Hide My Email” brings email obfuscation to Safari, Mail and MacOS.
Third, Apple is not alone in developing features to scope email to a single place. Google Chrome’s WebID proposal, part of its suite of proposals in Privacy Sandbox, sets out to do the same thing and arguably at a greater scale given Chrome’s market share.
Of course some entity must hold a mapping between the domain or app-scoped email and the person’s actual email address, otherwise there isn’t a way to reach the person at their actual email address. In the case of Apple’s features, the holder of the mapping is Apple. In the case of Chrome’s WebID proposal, the holder of the mapping is the browser implementing WebID.
Finally, none of the new email obfuscation features affects advertising alone. They are in play for other first-party applications of a customer’s email address where first parties choose to connect with one another. Marketers and publishers should take note of the strategic, upstream position operating systems and browsers are in, between them and their customers and potential customers.
What do the announcements mean for investing in industry led frameworks for advertisers to match audiences with publishers’?
Taken at face value these announcements seem to put a stop to email-based technologies advertisers and publishers might use to connect audiences. There’s no doubt that this is a goal as both Apple and Google have stated their aim is reducing cross-site/app tracking. But in this case, not all marketer to publisher audience matching technologies appear to trip this platform-defined privacy threat. For example, Ads Data Hub, Google’s powerful cleanroom product, exists to connect advertiser audiences to Google’s audience to encourage and facilitate ad spend on Google’s owned and operated properties.
It should be clear that it’s increasingly important to understand what makes an audience connection product like Ads Data Hub immune from being considered cross-site/app tracking. One hypothesis is that it’s ok when two first parties decide to connect with one another: Google and whichever advertiser knowingly load data into Ads Data Hub for a link. This could indicate that if the publisher has its own cleanroom and buy-side ad tech in-house, it is not engaging in the platforms’ definition cross-site/app tracking when the match happens in the cleanroom—via email or otherwise. This is unlikely correct though because one couldn’t reasonably expect most publishers to build their own in-house cleanroom and buy-side ad tech in order to carry out any desire to offer specific advertisers linkages on shared audiences.
Security and control are more likely explanations for why one form of audience matching is permissible or at least less of a privacy threat according to a platform asserting first party primacy and another is not. It stands to reason then that if industry led audience matching frameworks aim for and achieve ever-rising levels of security and control, platforms may be willing to let first parties determine how they interact with one another when it comes to audience matching for digital advertising. Furthermore, if we continue down a path toward clearer and more consistent messages to users plus simplified controls that are reliably demonstrated to work, an industry led framework could be an alternative to proprietary and inventory specific audience match activation tools.
This is why IAB Tech Lab believes we all need to get to work to realize the potential of the portfolio of recent privacy and addressability releases. This means we need to come together, finalize new privacy, accountability, and addressability specs so that the ecosystem can get to adoption. Additionally, the ads ecosystem must continue to lean into supply chain and data transparency standards to shine a light on when and how technologies connect advertiser and publisher audiences.
Are open ad ecosystem developments like UID 2.0 impacted by Apple’s Hide My Email?
Yes. However, the level of impact will correspond inversely with the level of effort we all—marketers, agencies, ad technology companies, and publishers—collectively put into creating smarter first party controls, consistent, simplified and non-overwhelming transparency and user-level controls that the entire supply chain can read, and a wide array of standardized technical hooks to allow for continuous technical accountability across participant types. This work puts first parties and their customers in positions of control. We’re making progress on all of those fronts. We’re excited to see how many people are leaning in to actually raise the bar for privacy, accountability, and addressability. But we cannot let up. We all have to continue pushing towards a future that doesn’t just recreate the problems of the past. We must not approach these changes with a workaround mindset.
We hope first parties are paying attention to this challenge to their standing.
Alex Cone
Vice President, Privacy & Data Protection
IAB Tech Lab