New Privacy Features in iOS 13 Let Users Limit Location Tracking

Apple's soon-to-be-released iOS 13 includes multiple features designed to give iPhone users substantially better control over their privacy and security settings for both personal and business use.

Apple today announced it will release iOS 13 on September 19, one day before the company's scheduled rollout of the new iPhone 11 Pro and iPhone 11 Pro Max phones. The new operating system will be available as a free update to users of Apple's iPhone 6S and later.

On the consumer side, one of the most significant privacy improvements in the operating system is a feature that allows users to limit the location data a mobile application can collect about them. They will have the option of deciding whether to share their precise location with a mobile app always, only when the app is in use, or never at all. In essence, users will have the ability to prevent a mobile app from running in the background when they're not using it.

Other location-related features include a control that prevents apps from accessing location information without permission when a user is using Wi-Fi or Bluetooth, and another that alerts users when an app is using location data in the background. Significantly, the notification will include a map of the location data that an app has collected, along with the app's own explanation for why it is collecting the data. A user can then decide whether to limit the app's location collection ability.

"From an application perspective, the new iOS is adding some more detailed controls around the location data that apps receive from the operating system," says Harrison Van Riper, strategy and research analyst at Digital Shadows. "Over the last few months there have been several high-profile location data exposures, so this could be a response to that."

For third-party application vendors and services that depend on location tracking, the changes could make a huge difference. Facebook, whose privacy practices have come under searing scrutiny in recent months, is easily the most prominent among those that will be impacted by the changes. With iOS 13, users will be able to restrict the social media giant's ability to track their movements and ensure it obtains their permission before accessing location data when the user is using Wi-Fi and Bluetooth.

In a measure of concern, Facebook in a blog Monday warned users about the impending changes with iOS 13. The company, whose revenue depends largely on its ability to monetize user data, stressed the platform works better with location information.

The company reminded users that location information powers features such as check-ins and event planning, besides enabling better ad targeting. "Features like Find Wi-Fi and Nearby Friends use precise location even when you're not using the app to make sure that alerts and tools are accurate and personalized for you," Facebook said.

Beyond Location
Meanwhile, other consumer-facing enhancements in iOS 13 include a new Sign-in With Apple ID feature that will give users the option of signing into applications and websites using their Apple IDs.  

"With the new feature, iOS 13 will highly encourage two-factor authentication," Digital Shadows' Van Riper says. "If a user was to select 'Sign in with Apple' to create a new account, their Apple ID has to have two-factor authentication enabled in order to use the feature." They also will be required to use either Apple's Touch ID or Face ID when creating the account, Van Riper notes.

Users who don't want to share their email with a particular app will have the option of letting Apple create a unique single-use email address that forwards to the user's actual email address. The feature will work on all supported Apple devices, as well as on Android and Windows applications.

All iOS applications that require a user sign-in will be required to support the new Apple sign-in option. "These are all great steps in the right direction in preventing unauthorized account takeovers and illegitimate account creations," Van Riper says.

Importantly, since a third-party website will also be using temporary credentials generated by Apple, user data isn't persistent and cannot be commoditized and resold as it can with similar options from Google and Facebook, says Russ Mohr, Apple evangelist at MobileIron.

Enterprise Use
With iOS 13, Apple has also introduced some new features for protecting user privacy in a workplace setting. The most important among them is "User Enrollment," a feature designed specifically for bring-your-own-device (BYOD) environments. It creates an entirely new and encrypted partition on a device and associates a Managed Apple ID that is used only for work apps and data, Mohr says.

"Apple is clearly targeting a population of users that were hesitant to give IT visibility into their devices," he notes. "With User Enrollment, iOS and MacOS users can be sure that IT departments can't view their apps, can't wipe their device, and aren't privy to other [identity] information like SIM information or even their personal Apple ID," he says.

With iOS 13, Apple is also providing new extensions that make single sign-on easier for enterprise organizations to implement. The technology is underpinned by the use of certificates and modern authentication, which is both easier for employees and more secure for the enterprise, Mohr says.

Unlike Google's Managed Profiles on Android, Apple still does not allow two instances of the same app to run on a device. Support for such a capability would allow users that use an app for both personal and business — like email, for instance — to keep their data completely separate, Mohr says.

"It seems like Apple will go down the path of personas, though, as they have with the Notes app, which has some data tied to the business account and some to the personal account," he notes. Currently, only business data is backed to a business iCloud account, and the data is automatically removed when the device leaves company management, he says.

Details of Apple's new iPhones together with pricing and availability information are available here.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Phishers' Latest Tricks for Reeling in New Victims."