Towards the end of January 2021, Apple announced a new innovation in its iOS 14 mobile operating system. The feature, called “ App Tracking Transparency” (ATT) is designed to enhance an iPhone user's privacy by requiring all apps used on the device to ask for explicit permission to track the user or the device.
Generally, when a user opens and app on their phone, the app may track the user across other apps and websites to direct targeted advertising, to them, based on the user's demographics, buying history and social media activity. Apple has previously done this with software known as “the identifier for advertisers (IDFA)”, which is able to track and identify a user without revealing their personal information.
The new feature, according to Apple, will make the process more transparent, by requiring apps to get the user's permission before tracking their personal information across apps or websites owned by other companies. Users will be able to see which apps have requested permission to track their data and can choose to allow or refuse permission to any or all of them.
How this works in practice is that the user will receive a pop-up notification saying something like: “[Name of company] would like permission to track you across apps and websites owned by other companies. Your data will be used to send you personalised advertising.” The user will be asked to choose to allow tracking or not.
There is no doubt that the ATT feature will make it easier for users of devices where it is installed to monitor the apps that are tracking and sharing their personal information and give effect to their rights to control it, so it is not surprising that the feature has been widely hailed in the media as a boon for consumers who are assailed by unsolicited and often unwanted online marketing. Apple is attracting plaudits for taking the initiative to protect its customers' rights to privacy.
On the other hand, tech media companies, such as Facebook and Google, are less enthused. They are heavily reliant on advertising revenue generated from targeted advertising based on data collected via mobile phone apps and claim that the ATT feature is anti-competitive, as it forecloses a large sector of the market to them and to many small and medium-sized businesses who rely on targeted advertising via social media and apps for much of their revenue.
What are the legal issues and how are they likely to play out, in South Africa at least?
Privacy/Data Protection
The data protection laws in different countries provide for direct marketing in different ways. In general terms, a distinction is drawn between those systems that apply an “opt-in” approach to data collection, where the consumer must be asked for consent before their data can be used, and those that apply an “opt-out” approach, allowing personal information to be used unless the consumer objects.
The EU's General Data Protection Regulation (GDPR), for example, follows the “opt-out” approach. Assessed against that approach, Apple's ATT feature may be said to go too far, by seeking to provide consumers with a level of protection against data collection to which they are not strictly entitled and interfering with online advertisers' freedom to trade. However, the GDPR must be read in tandem with the EU's Privacy and Electronic Communications Directive 2002/58/EC (“the Directive”), which predated the GDPR by almost a decade. The Directive provides that an electronic communications services provider may only process personal data collected from subscribers for the marketing of electronic communications services or for the provision of value added services “if the subscriber has agreed to this on the basis of accurate and full information given by the provider of the publicly available electronic communications services about the types of further processing it intends to perform and about the subscriber's right not to give or to withdraw his/her consent to such processing”. In other words, an “opt-in” requirement is imposed in the case of marketing of electronic communications services”.
South Africa's Protection of Personal Information Act (“POPIA”) also adopts an “opt-in” approach and prohibits processing of personal information for the purpose of direct marketing by means of any form of electronic communication, unless the data subject has given his, her or its consent to the processing or is an existing customer of the party by whom the information is processed.
Ultimately, in both South Africa and the EU, even where the “opt-in” requirement applies, the duty to obtain the consents rests on the operators of the individual apps themselves, all of whom are, even with Apple's feature, in place, obliged to seek the consent of the consumer to their information being processed. Therefore, while the feature may indeed make it easier for Apple users to monitor and control the use of their data, it is no more than a useful add-on feature; there is no legal obligation on Apple, in its role as the provider of the technology by which the apps communicate with users, to provide that protection.
Competition / Antitrust
So, given that Apple is not under a legal obligation to provide the app, are the companies who see its action as anti-competitive justified?
Amongst the stated purposes of the South African Competition Act, are:
- to provide consumers with competitive prices and product choices; and
- to ensure that small and medium-sized enterprises have an equitable opportunity to participate in the economy.
An arrangement or practice that has the effect of reducing either the quantity or the quality of products or services available to consumers violates the first of these principles. One that denies SMME's access to a large sector of the market would violate the second. However, to determine whether the arrangement or practice is actually unlawful, one would have to consider the wording of the relevant legislation.
While bi-or multilateral arrangements between parties can, by their nature fall foul of the Competition Act, a unilateral act by a firm that impedes or prevents any firm from entering into, participating in or expanding within a market only contravenes the Competition Act if the “offending” party is “dominant”, within the meaning of section 7 of that Act. To be dominant, a firm must have at least 35% of the relevant market or be shown to have “market power”. “Market power” is the power to control prices, exclude competition or behave to an “appreciable extent” independently of its suppliers, customers or competitors. On all the statistics available, Apple does not reach the 35% threshold; figures published by Statcounter show that its market share in South Africa between February 2020 and February 2021 was about 16%. It is also highly unlikely to pass the test for market power, considering that its two largest competitors, Samsung with almost 45% and Huawei with almost 29%, far exceed Apple's market share. It would not seem that a competition law challenge to the implementation of ATT would succeed in South Africa. In the USA, the situation may well be very different, with statistics from that country showing Apple's market share in Q4 of 2020 hitting 65%.
There is no question that Apple's approach to protecting its users' privacy may be public-spirited (and make good marketing sense by making the chore of selecting which apps you want to track you a lot easier). However, there may be a commercial downside. With information less readily available for advertising and marketing, operators of apps and online services will have to source this information in other ways, incurring costs that will ultimately be passed on to consumers. It is a recognised truism that, if a consumer gets a product at no charge, the consumer himself may be the supplier's reward.
iPhone users may find themselves paying for apps instead, which means they are in effect paying to protect their privacy. Not everyone may find this expense justified.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
