  Tracking is a highly privacy-invasive data collection practice that has been
ubiquitous in mobile apps for many years due to its role in supporting
advertising-based revenue models. In response, Apple introduced two significant
changes with iOS 14: App Tracking Transparency (ATT), a mandatory opt-in system
for enabling tracking on iOS, and Privacy Nutrition Labels, which disclose what
kinds of data each app processes. So far, the impact of these changes on
individual privacy and control has not been well understood. This paper
addresses this gap by analysing two versions of 1,759 iOS apps from the UK App
Store: one version from before iOS 14 and one that has been updated to comply
with the new rules.
  We find that Apple's new policies, as promised, prevent the collection of the
Identifier for Advertisers (IDFA), an identifier for cross-app tracking.
Smaller data brokers that engage in invasive data practices will now face
higher challenges in tracking users - a positive development for privacy.
However, the number of tracking libraries has roughly stayed the same in the
studied apps. Many apps still collect device information that can be used to
track users at a group level (cohort tracking) or identify individuals
probabilistically (fingerprinting). We find real-world evidence of apps
computing and agreeing on a fingerprinting-derived identifier through the use
of server-side code, thereby violating Apple's policies. We find that Apple
itself engages in some forms of tracking and exempts invasive data practices
like first-party tracking and credit scoring. We also find that the new Privacy
Nutrition Labels are sometimes inaccurate and misleading.
  Overall, our findings suggest that, while tracking individual users is more
difficult now, the changes reinforce existing market power of gatekeeper
companies with access to large troves of first-party data and motivate a
countermovement.
