Free VPN iOS App ‘Request to Track’ Compliance Investigation

Since April 2021, iOS apps have had to ask permission before tracking your activity across other apps and websites in order to deliver targeted advertising.^[1]

This “Request to Track” should appear as a dialog box every time you install a new app containing ads on your iPhone or iPad, unless you have opted to universally block them in your privacy settings.

This new feature, dubbed “App Tracking Transparency”, is part of Apple’s ongoing public pivot to privacy. That strategy also included the launch of new App Store privacy labels,^[2] which we found to be flawed in a recent VPN (Virtual Private Network) app investigation.

In light of those findings and Apple’s spotty record at enforcing its own privacy guidelines, we decided to investigate whether free VPN app developers actually comply with users’ wishes when they refuse to consent to ad tracking.

This issue is of particular importance for VPN users, given the privacy-focused nature of personal Virtual Private Networks.

As most free apps generally are supported by advertising, it’s in their developers’ interest for you to say yes to ad tracking. Targeted ads are more effective, which means more revenue for the developers.

In the screenshots below you can see how the hugely popular free VPN app Hotspot Shield tries to nudge you into allowing ad tracking in a splash screen that’s displayed immediately before the “Request to Track” dialog.

Note that Hotspot Shield was one of the tiny minority of free VPN apps (15%) that actually respected users’ refusal to permit ad tracking.

Unfortunately, we found that the majority of apps are so desperate for revenue that they continue to share tracking data with advertisers even when consent is denied.

In the course of our investigation we also discovered that over a third of free VPN apps ignore Apple’s supposedly mandatory guidelines and fail to seek consent at all.

We also found a loophole exploited by the 80% of the VPN apps we tested, whereby they shared tracking data with advertisers in the window between first launching the app and the Request to Track being made.

How did we test the VPN apps?

To conduct our research, we identified the 20 most popular ad-supported free VPN apps on the U.S. version of Apple’s App Store. In a controlled testing environment, we installed each app and monitored its network traffic as we launched it then connected and disconnected to various VPN servers.

After determining the point that we denied the Request to Track, we were able to identify any subsequent traffic to third-party advertisers that contained user data that could be used for tracking.

We found three types of user data:

1. Real IP address
2. Highly-detailed device information with the potential for fingerprinting
3. Basic device information

The sharing of a VPN user’s real IP address with third-party advertisers is particularly problematic given the core functionality of a VPN involves hiding that information.

The highly-detailed device info comprised long lists of very specific data points, some of which included:

• Network operator
• Free memory
• Battery level
• Screen brightness
• Device volume
• Device name (ie Bob’s iPhone)
• Free storage space
• Last time device was switched on
• Screen height
• Network Connection Type (ie WiFi)
• Screen width
• iOS version
• Device model
• Language

As with browser fingerprinting, the collection of such granular information about your device can be used to identify and track you. Apple says fingerprinting is against its rules.^[3]

We classed as “basic device information” any data sharing with advertisers that was limited to iPhone model, iOS version, screen height and width, language and country, along with some other general data points.

This basic information can’t strictly be used by advertisers to track you. However, we included it in our findings as in our view it should be made clear that this type of data will continue to be shared with advertisers even when you refuse to allow ad tracking.

Why did we do this research?

We’ve been campaigning to force Apple to pay more than lip service to its own guidelines as they relate to iOS VPN apps since 2018.

Free VPN apps are hugely popular, not only in the U.S. and Europe but also and especially in the global south and with people living in high-censorship regimes.

We want Apple to treat privacy as more than just a marketing gimmick that lulls iOS users into a false sense of security.^[4]

The goal of this investigation is put pressure Apple to actually enforce its own app privacy guidelines and remove any apps from its store that are in breach.^[3]

This would make it easier for anyone to choose a free VPN with peace of mind about their privacy.

• Aarki
• AdColony
• Adnexus
• Casale Media
• Chartboost
• Google (DoubleClick)
• Facebook
• Flurry
• GumGum
• Mopub
• presage.io
• Revenuecat
• Smadex.com
• Stack Adapt
• Supersonic Ads
• Tapjoy Ads
• Unity
• Yandex

By far the biggest recipient of user date was Google via its DoubleClick platform. All but two of the apps shared user data with Google either before or after the “Request to Track” was made.

Most of the other entities in the above list are ad exchanges, ie platforms that facilitate the trade of vast amounts of digital ad inventory and offer powerful tools that exploit the user data harvested by apps, such as those in this report, in order to better target their ads.

Note that while Flurry is well-known for its mobile analytics service, it also offers app monetization tools.

We identified the 20 most popular ad-supported free services in the U.S. version of the iOS App Store based on the most recent install data available from SensorTower.

We captured and analyzed internet traffic to and from each app using the mitmproxy tool. After identifying the point at which permission to track was denied for each app, we were able to determine what information was subsequently shared with third-party advertisers. We also identified all information shared before that point.

Our test device was running the most up-to-date version of iOS at the time of publication.

^{[1] https://developer.apple.com/documentation/apptrackingtransparency ↩}

^{[2] https://developer.apple.com/app-store/app-privacy-details/ ↩}

^{[3] https://developer.apple.com/app-store/user-privacy-and-data-use/ ↩}

^{[4] https://www.apple.com/uk/newsroom/2021/01/data-privacy-day-at-apple-improving-transparency-and-empowering-users/ ↩}