Android privacy changes are coming — are you ready?

A few weeks ago, Apple made the change that app developers, advertisers, and Facebook have long fretted about: They moved access to the Identifier for Advertisers (IDFA) and the ability to “track” users across third-party sites and apps behind an opt-in. Developers and advertisers who weren’t immediately hit hard by Apple’s swing are waiting for the second shoe to drop: Google’s inevitable changes to the Android AdID.

Early signals indicate a wide range of opt-in rates for iOS tracking. Some of the apps I’ve spoken to say they are seeing up to 45-55% of users opt-ing in. But wider surveys seem to indicate that average opt-in rates are hovering around a more disappointing 5-10%. We don’t quite yet know who will be better off and who will be worse off as a result of the change.

Many expected Google to announce similar changes to Android AdID at its developer conference last week, but the announcement didn’t materialize. If you think the silence means the blow isn’t coming, don’t be fooled. It’s just delayed.

The good news is that developers don’t necessarily need to hang in anticipation — they can evaluate Google’s potential moves to determine and implement a strategy that helps mitigate the impact of Google’s eventual decision.

Here are three paths available to Google, along with the likelihood and suspected impact of each.

Option 1: Letting Android play in the Sandbox

The most complicated shift would be a move to deprecate the Android AdID and move ad delivery and reporting into the Android operating system. Such an approach would build on the work of the Chrome Privacy Sandbox team and could mirror some features of Apple’s SKAdNetwork. At a high-level, solutions like Privacy Sandbox and SKAdNetwork disintermediate the relationship between the developer/publisher and consumer.

While there is a robust debate about whether this approach is good for consumer privacy, what is less arguable is that it would strengthen the platform at the expense of independent ad tech, advertisers and, likely, publishers and app developers. Google is already facing investigations into the competition (and privacy) implications of Privacy Sandbox. Can Google realistically afford an assault on Android from competition regulators?

Conclusion: This option is unlikely, but still possible if Google decides to align Chrome and Android.

Option 2: Google as cop on the beat

Another option would be for Google to mirror the approach Apple has taken with the Ad Tracking Transparency Framework, putting the Android AdID behind an opt-in and launching an associated policy framework to regulate and enforce a broader definition of tracking. Remember, tracking on iOS involves a whole host of data uses beyond just access to the IDFA.

While this outcome isn’t out of the realm of possibility, it would alienate two sets of stakeholders Google cares deeply about: app developers and advertisers. App developers would find it harder to understand if their advertising is driving app installs, and advertisers would find it harder to deliver personalized ads in apps. In contrast to Google, recent Congressional testimony seems to indicate that Apple views developers with some healthy paternalism, and Apple doesn’t have a vested interest in the advertising ecosystem.

If Google does end up going the route of a major policy change around “tracking” accompanied by enforcement, expect a collaborative rollout process that gives developers and advertisers time to adequately prepare for such a meaningful change.

Conclusion: This option could happen, but Google would be risking a lot of blowback from stakeholders it cares about. 

Option 3: Opt-in, but with a respect for the law

A lighter-weight alternative to Apple’s approach would be to move the Android AdID behind an opt-in but without requiring the consent screen for additional forms of tracking as Apple has. Moving the Android AdID behind an opt-in is a technical change, whereas requiring the opt-in for other forms of tracking, like the collection of an email address at login, is a policy shift. This approach would provide consumers with additional transparency and choice, while avoiding the thorny policy debate that has emerged around how to define tracking.

App developers could collect and use other data besides the Android AdID in compliance with laws like California’s Consumer Privacy Act, Virginia’s Consumer Data Protection Act, the EU’s General Data Protection Regulation, and — hopefully someday soon — a comprehensive federal U.S. privacy law. And this approach would leave the debate over what constitutes tracking to those elected to grapple with hard trade-offs and settle policy debates: the U.S. Congress.

This is the most likely scenario for three reasons. First, it is clearly a step in the right direction for consumers. Second, it would help satisfy the concerns of privacy regulators. Finally, it would preserve the trust of app developers and advertisers.

Conclusion: Ding ding ding — this seems like the winner. 

With an announcement expected in the coming months, developers and advertisers must use this time to place their bets on which of the above three options is most likely to come to pass and then furiously plan and prepare.

Here’s one more thing to remember: Whatever path Google chooses, consumer privacy is going to be prioritized. This likely means that the future will involve less data scale, smarter data science, and a more clear explanation of the value exchange that occurs when a consumer chooses to allow their data to be collected and used. Trust has to be at the core of all that we build.

Tyler Finn is Director of Data Strategy at Foursquare.