What Apple security means for franchise advertising

In the past few years, Apple has released numerous security features that are intended to protect iPhone and Macbook users’ personal data. However, in doing so these changes have also disrupted the standard methods of targeting and conversion tracking of digital campaigns for franchise brands. Here is a breakdown of these features and what sort of impact they cause:

Desktop (Macbooks):

For Desktop devices, Apple leverages the Safari browser to provide personal security. This is accomplished by removing the cookie ID that websites and marketing pixels use to identify users (typically and on non Safari browsers, the cookie ID remains the same until manually changed by the user). This will occur 24 hours after the user has visited a website. This means:

• Users who return to a website within 24 hours will be recognized by the website and marketing pixels implemented on the site. Actions completed by this user would be attributed to digital campaigns and eligible for placement into an audience.
• Users who return to a website after 24 hours will not be recognized by the website and no actions performed will be attributed to digital campaigns as conversions nor would be eligible for placement into an audience.
• This is specific to the Safari browser and not inherent to mac computers; a macbook user who browses the internet with Chrome will not be subject to the same protocol.
  
  

Mobile (iOS 14+):

For iPhones, Apple operating systems iOS14 and later generations give users the ability to not allow app publishers to retrieve the IDFA (Identifier for Advertisers) from the device. Previously, app publishers and advertisers could leverage using the IDFA to deterministically target users for advertising. Now, anyone who has opted in to Apple’s security will not have an IDFA that is visible to app publishers. Advertisers use IDFA in a manner akin to cookies on desktops; as a means of determining who is converting and/or to place in an audience list.

• Unlike with Safari browsers, IDFA will not be visible to publishers/advertisers for any amount of time. Neither the user nor the actions they perform in-app are trackable or eligible for placement into an audience.
• Users performing actions via in-app browsers (Facebook/Instagram) will not be trackable despite performing these actions on a website.
• This practice only occurs for users who opt in and use iOS14 or later, though data suggests this is true for the majority of iPhone users and is growing.

Both of these security protocols will directly and significantly impact conversion tracking and first-party audience building:

• People who were brought to a website by an ad that convert after more than 24 hours will not be attributed back to the campaign
• People who have been away from the website for longer than 24 hours will not be targetable for remarketing.
• People who have used an app to perform conversions will not be directly trackable
• People who have performed actions in-app will not be placed into remarketing audience lists

Why should you care?

Beyond the direct impact of these security measures, there are downstream effects which impact several aspects of a digital marketing practice:

• Reduction in the quality of campaign evaluation.

To be fair, part of this impact is ultimately superficial - if conversions are still occurring, does it matter whether the ad platform can accurately attribute it back to the campaigns? Even if conversions are still taking place, without attribution, marketers will not know what tactics and combinations of tactics are performing or not performing. This can drastically complicate standard practices like budgeting, media planning, and forecasting.

• Ad platforms need conversions to optimize bidding and delivery

Once upon a time, it was common to manually bid in Search and Display advertising. That is no longer the case and increasingly so as technology advances. However, these platforms accomplish these feats by ingesting and analyzing user conversion data and considering that alongside other performance metrics. By removing a portion of this dataset, which can be a much larger percentage of total user data for some advertisers, this greatly reduces the accuracy and thus capabilities of these automated operations.

• Limits and/or skews first party audience pools, possibly away from high value users.

As iPhone users are effectively “removed” from audience pools, this can massively limit the total size of the audience or for some tactics, all but eliminate the entire pool. This may also lead to heavily skewing audience pools towards users of trackable devices (Windows, Android, Chrome, etc) which, for many brands, does not align with their customer base.

What can you do?

There is no sign that Apple will ever retract any of these measures and are instead advancing the reach that they have. Generally speaking, this coincides with a larger industry migration towards limiting or eliminating Personally Identifiable Information (PII) from being used within ad platforms altogether. Taking actions now is imperative for the present and future.

• Invest in technology
  

  There are a growing number of solutions that are making use of “cookie-less” tracking which is not vulnerable to the same restrictions Apple has put into place. Customer Data Platforms (CDPs) such as mParticle provide users with both attribution and audience building capabilities that can be used across ad platforms.

• Reorganize your media targeting configuration
  

  Bucket mac/ios targets into their own groupings to specifically monitor ad performance in a silo; this will assist in deducing if remarketing campaigns are able to spend effectively and specific impacts to conversion attribution. This will also provide the basis to treat these groupings accordingly; you may want to use different bid strategies/audience personas/inventory/keywords/etc between groupings based on your findings.
  

• Leverage historical data

  
  Review patterns/trends/characteristics of mac/ios users from first-party data sets such as historical GA data, CRM data, POS data, etc to gain a better sense of common prospect/customer behavior. These insights can help you evaluate upper funnel/prospecting campaigns and tactics where the ability to remarket to iOS/Mac users is greatly reduced. When comparing prospecting spend with overall business revenue, has there been any significant change in performance? Does each dollar of prospecting spend still correlate to the same volume of revenue prior to Apple’s security enhancements?

• Approach every brand location uniquely

When you group many locations into a single DMA or region you limit your ability to measure results of advertising against real business outcomes. Instead, break out your brand advertising into individual, location-level campaigns - with dedicated budgets, localized creative, custom targeting, and click-thrus to a location-specific landing page. By doing this, you’ll be able to measure spend against metrics like actual sales, revenue, or order size per location.

• Monitor bottom line when all else fails

  
  Though Apple’s security measures have certainly limited many common and effective advertising tactics, it is not a given that this will have a strong negative impact on your business. Even if attribution indicates that campaigns are performing poorly, that does not mean that iOS/Mac users aren’t ultimately converting. Stay on top of bottom line performance and track over time (paying attention to the expected ebbs and flows of seasonality); it may or may not be the case that your business is suffering or significantly impacted by these security measures.