Apple's Mail Privacy Protection is lazy and hurts small publishers

At WWDC yesterday Apple announced Mail Privacy Protection, an initiative seeking to bring blocking of Superhuman style tracking pixels to Apple's Mail app.

In the video demo Katie Skinner, Manager of User Privacy Software, introduced marketing emails as using hidden pixels to collect your activity, such as your IP address, or when you open or take an action in these emails. Their solution is Mail Privacy Protection.

It hides your IP address so senders can't link it to your online activity, or determine your location. And it prevents senders from seeing if and when you've opened their email. So now you can catch up on email with greater peace of mind.

That's it. That's all we know so far. And though focused in this context on marketing emails, it has significant implications for publishers and the newsletter boom.

Litmus, an email marketing consultancy, estimated that the top email client globally is Mail on iPhone, with 38.9% of opens coming from the app in the first three months of this year. On desktop, if this feature launches on Apple Mail there, that's another 11.5% of sends. The current market share of both is expected around 57%.

This is probably a fuzzier statistic than I'd like it to be, but we can I think safely say that a lot of emails are going through this ecosystem.

As a publisher you probably have two statistics that you are using to determine performance via your ESP: open rate (the number of people who opened your email for any amount of time, judged by a small invisible image that is loaded uniquely per subscriber), and click through rate (the number of people who clicked on one or more of the links in the email, judged by each link being tracked via a forwarding service). Apple have just attempted to wipe out one of those.

We don't know how Apple accomplish this, but I think it's safe to presume that it's similar to how Hey.com announced their privacy push in their email client. Hey keep a denylist of tracker addresses, and scan your email for elements that look like they could hide a tracker (anything that's a 1x1 gif) to remove them.

Hey has a second line of defence also: if a tracker slips through via some more structural image, Hey proxies the request to the image via their servers, meaning your IP and approximate location are never leaked to the sender. Apple may or may not do this.

I'm broadly not against privacy online, and I think Hey.com's second step is especially good at protecting users from invasive tracking. In fact it's exactly what Google Mail started doing back in 2013. But, much like other generally-sensible-in-theory provision like the GDPR, moves like this from Apple are going to hit hardest the solo and freelance publishers with their Substack newsletters.

A major publisher will be hurt, sure. They'll lose a lot of data on which they sold their newsletter sponsorships. They'll be less able to confidently purge subscribers who haven't opened their newsletter in months (what if they're iPhone users?). They'll see their open rates drop 30%+ overnight.

But there will be ways around it. And suddenly, with over half your email data at stake, this is what both marketers and publishers will start working on in the coming months. Until emails are wholly plaintext there's always something you can make uniquely identifiable.

A smaller publisher, a local newspaper, a solo freelancer, a small blog; all these will lose data on a significant part of their audience. A likely valuable part of their audience. And it may stifle or slow their growth or opportunities.

Where previously you could unsubscribe readers who hadn't opened your newsletter to save money, now you don't know if they're loyal or not. You'll have to find other ways to entice them to let you know they are reading. A larger publisher can afford to keep 20,000 recipients on a list that never open an email. A smaller outfit cannot.

Apple's fight for privacy is really a fight against the web. In signing up for a newsletter, a publisher or marketer already has a more valuable piece of PII: your email address. By focusing on IP addresses, and blocking trackers rather than proxying them on a fuzzy delay¹ (which would provide the same useful publisher data without any PII leak of location or time), Apple are not really fighting for their users so much as they are fighting against email.

Apple every year see that the walls of their garden get higher. It's no doubt that whenever something like this happens, Apple have an in-ecosystem solution for you: launch an app on their store, post to their own publishing system Apple News, just don't use the open web.

Footnotes🔗

1. This really should be what Apple do instead: they know what the trackers are, so load them later, from a server rather than from the phone. Give the publisher the data that the email has been opened, and by whom (via the email address), but not where or when. ↩