Aurora Magazine

Promoting excellence in advertising

I Want My (App) Privacy

Published in Nov-Dec 2021

Yasmin Malik ponders how private Google's “Privacy Sandbox” actually is.

A few weeks before Covid-19 hit Pakistan in earnest, I was invited to attend The South Asia App Summit organised by Google and its apps analytics partner, Appsflyer, at a local hotel in Karachi.

The spotlight, during a very well attended event, was on established local apps, such as Bykea, Careem, Daraz, Easypaisa, Foodpanda and JazzCash which, at that moment in time, had amassed $100 million venture capital (VC) between them. The summit was focused on app growth strategy and the increasingly important mobile app attribution models. The latter is critical to understanding the success and performance of mobile app marketing campaigns.

Unlike online attribution, which relies heavily on cookies and pixel tags, mobile app attribution measures a user’s conversion activity within the app (installs, in-app purchases, etc.) using mobile device fingerprinting or Unique Identifier matching. Google may be king of the online world, but a deep-dive into mobile app usage is only possible for Google by partnering with app attribution specialist companies such as Appsflyer, Adjust or Kochava. Hence, when Appsflyer took the stage, a rapt audience was given a comprehensive and research-focused view of the ways attribution can radically improve app engagement and ROI.

This year, Google’s App Summit was conducted online. The numbers were even more impressive for the South Asian region, particularly for Pakistan: it ranks at number 13 in terms of global app downloads at 2.4 billion and $240 million VC investment compared to, for example, Bangladesh at number 17 and $125 million VC investment. The summit incorporated research data from Kantar on app engagement and brand affinity covering the retail, telco and finance verticals. Kantar pointed out that the highest increase in brand affinity (42%) occurs when a user “transitions successfully from on-boarding to regular use” of an app. For the telco vertical, the most common app behaviour is bill viewing, data usage tracking, top-ups and payment. Discounts and promotions keep users engaged with their telco apps. For example, 29% of telco app users regularly log in to check for deals or to redeem offers and rewards. 

What was entirely missing this year, however, were Google’s app attribution partners. Nary a mention of any of them. 

To those who have been following rival Apple’s introduction of its new user privacy feature (App Tracking Transparency) earlier this year; this may not have come as a complete surprise. 

Whilst Apple users have been able to opt out of Unique Identifier-based tracking in the past, this year Apple put that choice far more directly to the app user. With iOS version 14.5, every app developer that wants to track users and their data across apps has to ask the user’s express permission. If the user says ‘No’, the mobile phone’s IFDA (Unique Identifier) is disabled and the app developer cannot track that user’s data or cross-sell it to other companies. Apple is offering its own tool, SKAdNetwork, so that the developer can tell when a user has ‘converted’ without revealing any of that user’s personal data. This makes it difficult and more costly for mobile app attribution companies, like Appsflyer, to provide data for highly targeted ads, as SKAdNetwork will significantly limit their own access to the user’s app activity data.

The biggest complainant about Apple’s move has, obviously, been Facebook. Eighty percent of iOS Facebook users are expected to opt out of tracking via App Tracking Transparency (source: Forbes).

But where does that leave the digital world’s other behemoth, namely the aforementioned Google...? 

In light of recent user data breaches and privacy laws such as GDPR, Google is unquestionably feeling the heat from user privacy advocates. To mitigate user concerns, Google announced the end of support for third-party cookies by 2022 and is working towards a new set of APIs for advertising via a plan it calls “Privacy Sandbox”. Google’s mission, in its own words, is to “introduce its own tools as an alternative for advertisers to use”.

This mission was flagrantly obvious in this year’s App Summit. A large part of the summit’s agenda was focused on Google’s new privacy/Sandbox tools and it was little better than a brazen promotion of its GA4F & GA4 Analytics suite – a step up from its 2016 Firebase SDK app analytics tool. The GA4F suite is a “privacy-first, cross-channel measurement platform built to scale with your business and allow prediction and action with Google and beyond, and includes conversion measurement, deep linking and user journey measurement. 

In effect, trusted third-party mobile app attribution partners were unceremoniously ditched with the new suite. The explanation of how the new suite works was clunky and unsophisticated and remained ambiguous with respect to attribution, even with case studies of Daraz and the Spanish fintech Rebellion Pay included in the presentation. For Daraz, the case study showed how Firebase enabled “faster app campaign optimisation” growing installs, orders and GMV from new users in both Pakistan and Bangladesh. Whilst it is great to gain a burst of new users using cross-promo techniques, it does little to engage existing users who form the basis of the app’s ROI. Similarly, the Rebellion Pay case study did not even touch on attribution, focusing instead on the use of relevant digital assets (images, videos) on an awareness campaign of the app to target a younger audience. 

The truth of the matter is (and I have had no qualms in advocating this opinion for years) that Google does not know how to do mobile. It didn’t when it tried to overcome this handicap when it took over the unrivalled Admob mobile marketing company in 2010 and it knows little better now with the push for its GA4F suite over analytics experts such as Appsflyer and Adjust. In fact, by disassociating itself from third-party attribution partners, Google is hurting the advertising industry which has been an advocate of these partners. They brought a sense of balance in terms of measurement accuracy, plausibility and user privacy of digital marketing campaigns and had set a best industry practice standard.

Furthermore, the summit begs the serious question of how Google’s new user privacy tools will measure up to the experimental Privacy Sandbox project. The purpose of the project is to “provide anonymity to user data, while at the same time using APIs to continue to allow advertisers to use behavioural targeting.” Five APIs will be used for advertisers to aggregate data, conversion and attribution. The most important API may be the FLoC (Federated Learning of Cohorts) – a machine learning technique aimed at forming a centralised model without actually exchanging data. Google envisages it to work by grouping different sets of users by their usage habits – termed rather vaguely as ‘signals’ in the aforementioned GA4F suite – and trying to “establish shared meaning” whilst the personal identities of users will be concealed.

So what does the Privacy Sandbox mean for publishers and ad networks? It is likely that the proposed APIs will become ad industry standards for adoption, especially since the World Wide Web Consortium is involved in the project. 

The concern, understandably, remains that Google will leverage all of this for its own gains by giving its own dedicated advertising teams more access to data in the Privacy Sandbox than to ad tech vendors, publishers and advertisers. They have dubbed this Google’s “Walled Sandbox” – if their fears are realised, they will have to “rely on Google’s first-party logged-in data, without being able to gain access to any real data directly from their audiences.”

Regrettably, all this may take us back to square one: the long-standing industry view that Google is anti-competitive. Indeed, the UK’s Competition and Marketing Authority has already opened an investigation into the Privacy Sandbox at the behest of digital marketing companies, newspapers and ad tech vendors. Battle lines are being drawn back to where they were a decade ago. May the best (digital) party win. 

Yasmin Malik is Senior Partner & Consultant, Dubai’s Global Management Consultants. yasminmalik1@yahoo.com