Apple, Firefox tools aim to thwart Facebook, Google tracking

In this June 4, 2018, photo Craig Federighi, Apple’s senior vice president of Software Engineering, speaks during an announcement of new products at the Apple Worldwide Developers Conference in San Jose, Calif. Facebook and other companies routinely track your online surfing habits to better target ads at you. Two web browsers now want to help you fight back in what’s becoming an escalating privacy arms race. New protections in Apple’s Safari and Mozilla’s Firefox browsers aim to prevent companies from turning “cookie” data files used to store sign-in details and preferences into broader trackers that take note of what you read, watch and research on other sites. (AP Photo/Marcio Jose Sanchez)

NEW YORK — Facebook and other companies routinely track your online surfing habits to better target ads at you. Two web browsers now want to help you fight back in what’s becoming an escalating privacy arms race.

New protections in Apple’s Safari and Mozilla’s Firefox browsers aim to prevent companies from turning “cookie” data files used to store sign-in details and preferences into broader trackers that take note of what you read, watch and research on other sites.

Lance Cottrell, creator of the privacy service Anonymizer, said Apple’s effort was particularly significant, as it takes aim at a technique developed by tracking companies to override users’ attempts to delete their cookies.

Safari makes these protections automatic in updates coming Tuesday to iPhones and iPads and a week later to Mac computers. Firefox has similar protections on Apple mobile devices and is rolling out them out to personal computers in the coming months.

To get the protections, you’ll have to break your habit of using Google’s Chrome browser, which by some estimates has more than half of the worldwide browser usage. Safari and Firefox have less than 20 percent combined.

Even then, Safari and Firefox can’t entirely stop tracking. For starters, they won’t block tracking when you’re using Facebook or Google itself. Nor can they help much when you use phone or tablet apps, unless the app happens to embed Safari, as Twitter’s iPhone app does.

But Will Strafach, a mobile security expert who is designing data security tools for phones, said imperfect protection is better than no protection. He notes that burglars can still break down a door, but that doesn’t mean you shouldn’t bother locking it.

Cookies and other trackers can be used by companies to keep track of who you are as you move from website to website. The companies can build a digital profile as you, say, read about Democratic or Republican viewpoints, buy a particular brand of pet food or indulge in the entire season of “Keeping Up With The Kardashians.”

News, video and other third-party sites use Google and Facebook cookies to customize ads to your hobbies and interests, rather than hawking products you might never buy. That’s why you might see an ad for shoes soon after searching for them elsewhere.

Apple says its tests show that some popular websites are embedded with more than 70 such trackers. Many of these are from Facebook and Google, which are expected to command a combined 57 percent of the $107 billion U.S. digital advertising market this year, according to the research group eMarketer.

Though general awareness of data collection has grown in the wake of Facebook’s Cambridge Analytica privacy scandal, how trackers work behind the scenes remains a mystery to many people.

Ghostery and other products have long offered tracking protection. The browsers are now trying to incorporate that directly so you don’t have to go looking for browser add-ons.

Safari will try to automatically distinguish cookies that are useful from ones that are there just to track you. Apple notes that cookies can appear in unexpected places, such as sites that embed “like” and “share” buttons. Now, those cookies will be blocked until you click on one of those buttons, in which case you’ll be prompted for permission to allow the tracking. If you don’t, your “like” won’t register.

Safari is also attacking a technique developed to circumvent cookie deletions. Through “fingerprinting,” a company can identify you through your computer’s characteristics, such as browser type and fonts installed. Your new cookie can then be tied to your old profile. Safari will now limit the technical details it sends.

Firefox has an anti-tracking feature that also tries to distinguish tracking cookies from useful ones. It’s on by default only on Apple’s mobile devices. Mozilla is testing a broader rollout for personal computers, though its plans for Android are not yet known. For now, you need to turn it on or use a private-browsing mode, which gets more aggressive at killing cookies, including useful ones.

For PCs, Firefox also has an optional add-on, called Facebook Container, to segregate your Facebook activity from everything else. Think of it as a wall that prevents Facebook from accessing its data cookie as you surf elsewhere. A version is available for other trackers, too, but requires configuration on your part.

None of the Firefox tools, though, address fingerprinting.

Unsurprisingly, advertisers aren’t happy.

In a statement, Interactive Advertising Bureau executive Dennis Buchheim said that even as browsers makers feel pressured to deliver privacy-centric features, they should consider the importance of advertising in enabling free services.

The new Safari and Firefox tools don’t block ads. But without cookies, websites might get paid a lot less for them, said Jed Williams, chief innovation officer at the Local Media Association, an industry group for news publishers.

Apple and Mozilla are able to push the boundaries on privacy because neither depends on advertising. Google makes most of its money from selling ads.

Facebook and Google declined comment on the Safari and Firefox tools. But Google said its Chrome browser offers tools to control and delete cookies and set preferences for certain websites. Google says users can also decline personalization and get generic ads instead, though tracking continues in the background while using the company’s services.  /muf