Is Apple Coming After IP Addresses Next? – WWDC21 Recap

Yesterday at WWDC21, Apple’s annual developer-focused (or rather software-focused) conference, they announced new versions of their operating systems as well as some interesting privacy updates. While I’m excited about some of the features in iOS 15, such as Live Text for capturing whiteboard notes from the camera, the privacy measures have me a bit more concerned.

No More Tracking Pixels in Email

Craig Federighi, Apple’s Senior Vice President of Software Engineering, started the Privacy section of the keynote by talking about the Mail app. Email tracking pixels will soon be blocked by Mail. This means email view/email open notifications for platforms like HubSpot or Marketo will be disabled, which seems like a reasonable measure. Furthermore, Mail will hide your IP address. I don’t use the Mail app, but I would be fine with these updates if I did.

No More IP Addresses in Safari?

However, Craig then mentioned that Safari would be obscuring IP addresses as well. My first question was how, exactly, is Apple planning to do that?

After doing a bit of digging, it’s still unclear to me whether Safari is going to obscure IP addresses for all traffic, or whether that requires the use of Private Relay (more on that below). 

This is where I’m a bit concerned. If IP address is truly obfuscated for all Safari traffic, it would make it much more difficult to do fingerprinting or probabilistic matching for mobile attribution. Apple has been quiet on fingerprinting since the release of iOS 14.5, perhaps because they knew this update was coming. IP obfuscation scope and functionality will be a key question to answer in the coming weeks.

Private Relay: The Apple VPN

Finally, they announced Private Relay, part of the new iCloud Plus service. While it sounds like a VPN at first glance, it’s actually doing quite a bit more work.

According to the iCloud Private Relay deep dive video, the service adds multiple secure proxies to help route user traffic and keep it private. The proxies are run by separate entities — one is Apple, and one is a content provider.

When someone uses Private Relay to access the internet, only the client IP address is visible to both the network provider and to the first proxy. The second proxy only sees the name the user is requesting and uses that to build the connection to the server. They claim that no one in the chain, not even Apple, can see both the client IP address and what the user is accessing. 

In Summary 

As usual, there are more questions than answers regarding these new privacy features. The reaction online has been largely positive from the tech press, and skeptical from industry press. The only constant is change, and we’ll keep our eyes open for new details as they arrive.