PCM: Apple's new alternative to cookies

When it comes to identifying users, cookies are the worst! Well, that's except for all the other ways to do that...

Besides all the commendable privacy-related features of the new iOS 14.5 (and iPadOS for that matter) there’s one that doesn’t improve, but instead harms privacy. That's Private Click Measurement, or PCM, an ad click attribution technology Apple has introduced for ad-to-web advertising within its new privacy-focused strategy.

Apple's crusade against ad tracking deflects attention from its own privacy issues: the all too familiar non-transparency of its "privacy-preserving" tools and the very limited control users have over their data. PCM is designed for advertisers, not users, and works within the context of Apple’s business relationship with renowned privacy offenders, such as Google.

It replaces cookie-based attribution with a complex process that’s meant to prevent advertisers from identifying the real person behind the click. The idea of replacing cookies is always welcome, but PCM distorts it and takes away any agency that users have over how their data is processed. Cookies are easy to see in the browser and easy to control, while PCM is a thing within itself. Users have to take the developers' word for it and believe the mathematical models and promises of anonymity.

Apple's new PCM technology is a mystery box in many regards

The introduction of PCM has a lot in common with Google’s plan to replace cookies with so-called "trust tokens", but limits the scope to ads. PCM also assumes "trust", but only in that the user is supposed to trust the non-transparent process. When PCM or trust tokens are employed, the user lets the browser collect an undefined small amount of data, pack it, encrypt it, and send it. Overseeing the needs of users and urging them that it’s in their best interest is disturbingly common among tech giants, and let's face it, a distinctive feature of Apple’s products.

There are many reasons it’s better to disable PCM. Even though it makes identifying a person slightly harder for advertisers, it doesn’t stop them from IP comparison or fingerprinting. Apple itself admits that PCM can be misused for other purposes. While Firefox, Chrome, other Chromium-based browsers, browser extensions, and standalone content blockers all offer reliable tools to control how user data is being processed, PCM virtually takes away control over an important part of web interactions. Cookies can be read, interpreted, and interacted with, but PCM can only be trusted or not.

The well-known location allows for a simple rule if content blockers want to block such conversion reporting.

You can find the PCM setting at General > Safari > Privacy Preserving Ad Measurement

That is, so far, content blockers can influence PCM, but any non-transparent mechanic, even if it claims to protect privacy, is instead a possible threat to it. For people who are serious about safety of their personal data, the AdGuard Tracking Protection filter allows to block PCM tracking along with cookie-based tracking. It even protects against fingerprinting and other means of tracking the user across apps and the web. Tracking Protection filter is available in all AdGuard products, no exceptions. If you made it to this point in the article, it's definitely in your best interest to switch it on.

Cookies as we know them today are quickly becoming a thing of the past, but what will the ultimate cookies successor look like? We don't know yet, but we know there's an already existing solution that seems to fix a lot of problems in a convincing way: Total Cookie Protection by Mozilla. They improved cookies rather than create a new technology from the ground up. But if you're going for the brand new solution, at least make it transparent to everyone. As it stands now, PCM comes across as a very raw technology at the very least.