• by Laurie Sullivan , Staff Writer @lauriesullivan, July 26, 2023

Peter Jakus, product manager at Bloomreach, said while Apple has tried to take the privacy lead among the major browsers, bad actors who abuse digital tracking technologies for nefarious purposes often rely on the same underlying tools such as cookies and URL parameters, as honest marketers.

"I like that Apple takes privacy seriously, but I don't like that the user has no say in it," Jakus said. "I don't mind being tracked when shopping for t-shirts, but I do in other situations. Apple doesn't give me a choice. GDPR really pushed the concept of consent. Now a lot brands have gradual mechanism when to use it and when not to use it. Apple doesn't think about this. They just have a blanket rule to protect privacy." 

Jakus put together some thoughts to teach marketers how to protect marketing investments after Apple announced iOS 17 for the iPhone at its developer conference in June, and released the fourth version of its beta to registered developers this week.

Jakus points to how Apple blocked some tracking parameters used by platforms like MailChimp, Google, and Facebook. He said there’s no noticeable difference to end user, but certain platforms are blocked. The list, he said, can be found at privacytests.org. Bloomreach has not been affected by Apple’s change.

He suggests marketers try to build strategies around zero-party data, information that customers voluntarily share with a business.

“When we notice that someone has stopped reading emails from a particular brand, we decrease the frequency because there’s no point in sending the email if its no use to the user,” he said. “To do that we need to track the email. When you click on the email, we also learn the most convenient time for you to receive it.”

Jakus conducted the research looking at four types of URL parameters in email.

1. mc_eid, fbclid, _hsenc and other parameters from this list.
   Most of them are ubiquotus parameters known to be used for user level tracking in popular platforms
2. Other parameters, not from the list, but that can also be used for user level tracking.
   Among others we tried wbraid=ohgcu5489ehijt2chdw0w3zhtrn52w, ScCid=7b3a7917-a82a-47e8–9728-e1b3b045abb2 and one that was literally called “user-id”
3. UTM parameters
4. Any of the above, but the array of parameters started with “#” instead of “?”

All tests he conducted use a redirector. Most marketing automation platforms don’t paste the link of the landing page into the body of the email. They first send users to a redirector, typically hosted on a CDN managed by the platform, and that send the user to the final website, he explains. It happens so fast that users won’t notice it unless they specifically pay attention.

Email platforms do this to count the redirects, and often tie it to an individual. They use it to reliably report email clicks.

When you use a redirector, Apple Mail will not see the URL parameters of the landing page, because it is added after the redirect, which happens in Safari. If the email/SMS platform doesn’t use a redirector, the findings don’t apply, but it is explained in detail here.