New Privacy Features Coming in iOS 15


iOS Safety

Apple just announced *some* of the new features coming in iOS 15 this morning. Whilst the features list is long, the privacy features are the important ones that need to be highlighted (yeah, forget about FaceTime on the web for Windows and Android users haha). Anyway, here is a quick rundown of the privacy features that are coming.

1. The new Safari has a different look and feel, but underneath, Apple just strengthened its protection for users' data. First is the automatic HTTPS upgrade, when HTTPS is available, of course. There are times when HTTP and HTTPS are both available on websites, with no HTTP to HTTPS redirection configured on the web server, Safari will choose HTTPS. There are browser plug-ins or extensions that do this, but now Safari added it by default. In addition to this, Safari's Intelligent Tracking Prevention (ITP) is now shielding the device's IP address from being collected.

2. I wrote about the Privacy Dashboard on Android 12, which Google announced not too long ago, even mentioning that Apple should copy it. Well, iOS 15 will come with App Privacy Report (APR). Similar to Privacy Dashboard, the APR will show you "how often apps have accessed your location, photos, camera, microphone, and contacts during the last seven days. It also shows you which apps have contacted other domains and how recently they have contacted them." One thing that Apple missed is the Privacy Dashboard's feature of being able to change the application's access permissions right from the dashboard. Nevertheless, this new section in the Privacy Settings complements the App Privacy Labels and App Tracking Transparency.

3. A few months ago, several new mail clients have been launched boasting of their email tracking pixel blocker. The current Mail application does not have this feature, which made blocking all remote images the next best thing. In iOS 15, Mail gains this Mail Privacy Protection feature to block these email tracking pixels. One thing, though, I am curious as to where it is getting the list of the domains to block.

4. If you are a paying subscriber to iCloud, Apple just rebranded it to iCloud+, I guess to differentiate it from the free one. iCloud+ comes with two (2) privacy enhancing features. The first one is Hide My Email - if you are familiar with "Sign In with Apple", this essentially extends this beyond just websites and applications that support "Sign In with Apple" with a familiar interface to generate your aliases. This hides your main email address and instead use randomly-generated aliases to sign-up instead. The email aliases generated are easy to read and type, compared to the highly random characters email address generated via "Sign In with Apple". In addition, iCloud+ will also support custom domain names! This is exactly what I am using via a third-party service called simplelogin.io. There isn't much detail on this iCloud+ Hide My Email feature, like is there a limit to the number of aliases? Is the iCloud+ custom domain only restricted to Family Sharing accounts, or can you invite others to use the domain.

5. The second iCloud+ privacy feature is the Private Relay. Network traffic, encrypted on the device, goes through Apple and then a trusted third-party proxy. It is not clear, however, if this is via a virtual private network (VPN) connection, coupled with their Oblivious DNS over HTTPS (ODoH) protocols. I guess it will only be evident once it launches. iCloud+ is now live for beta testers, but I can't test it since I am using my non-primary AppleID.

6. Finally, Apple has enhanced Siri to work offline (about time!) with on device personalization and processing. I guess Apple is slowly catching up with Google when it comes to their voice assistant model, but with more privacy protections.

These are just features that Apple announced at the WWDC21 keynote. Apple's push in protecting users' privacy is leaving competitors behind. The more privacy features being baked in Apple's devices, the closer we are to changing the current data economy, at least until the US government starts regulating these surveillance capitalists.