Everyone keeps saying ATT and GAID are about privacy. They’re not. They’re about control. Privacy is just the language we’ve agreed to use so nobody has to say the awkward bit out loud.
Apple didn’t introduce App Tracking Transparency because it woke up one morning with a conscience. It did it because it could. Because it sits at the choke point of the ecosystem. Because if you own the operating system, you get to decide who sees what, when, and on whose terms. That’s not ethics. That’s leverage.
Google’s GAID is the same story told more softly. Resettable, optional, user-friendly. Except everyone knows what happens when GAID disappears. The dashboards don’t stop demanding attribution. The board decks don’t suddenly accept “we don’t know”. So the industry does what it always does: it routes around the problem. IP addresses. Device signals. Probabilistic matching. Call it “measurement”. Pretend it’s not tracking. Everyone nods. Nobody wants to be the adult who says this is nonsense.
ATT didn’t kill tracking. It just made it selective.
If you’re Apple, you still have first-party data pouring in from every direction. If you’re Google, you’re sitting inside search, Android, YouTube, ads, analytics, the lot. If you’re anyone else — a bank, a fintech, a publisher, a Nigerian startup trying to grow without getting its head taken off by regulators — you’re told to put up a pop-up, accept the drop-off, and adjust your expectations.
Then, when growth stalls, you’re told it’s because users “value privacy”. Funny how that only ever seems to apply to companies without monopolies.
What really grates is the moral theatre. Platforms lecture everyone else about consent while designing consent flows that are deliberately exhausting. They talk about user choice while making sure the choice changes almost nothing for them. They talk about trust while keeping the most valuable data firmly inside their own walls, safely relabelled as “first-party”.
And regulators? They’re chasing yesterday’s problems with yesterday’s tools. Meanwhile, the real world has moved on. SDKs update themselves. Behaviour changes without code changes. Data flows are abstracted away behind contracts nobody reads and diagrams nobody has time to draw. When something goes wrong, it’s always “the SDK did it”, as if that absolves anyone of responsibility.
In places like Nigeria, the whole thing feels especially hollow. You’re expected to comply with privacy frameworks designed in Brussels and California, enforced through platforms that barely understand your market, while competing with companies that can lose half their data and barely flinch. You either slow down, cut corners, or quietly hope nobody looks too closely. None of those outcomes makes users safer.
Let’s stop pretending users are winning here. They get a blur of consent prompts they don’t understand, on apps they need to use, with language carefully engineered to push them towards “Allow”. Their data doesn’t vanish. It just flows differently, more unevenly, more invisibly. Control hasn’t increased.
Accountability has just been redistributed — mostly downwards.
The most dishonest thing about the ATT and GAID conversation is the idea that privacy is now “handled”. As if a system that still depends on surveillance, just relabelled and rerouted, is somehow virtuous. As if swapping one identifier for three weaker ones is progress. As if consent means anything when the alternative is exclusion.
If this industry were serious, it would ask harder questions. Do we actually need this level of attribution? Who benefits from it? Why is “growth” always treated as a natural force rather than a set of choices? But that would require admitting that a lot of what we’ve built is unnecessary, extractive, and brittle.
ATT and GAID aren’t villains. But they’re not saviours either. They’re power moves, dressed up as ethics, in a market that rewards scale and punishes everyone else.
Most people in tech know this. They just don’t say it, because the moment you do, you sound difficult. And being difficult is bad for business.
Until the day it isn’t.
Michael Irene, CIPM, CIPP(E) certification, is a data and information governance practitioner based in London, United Kingdom. He is also a Fellow of Higher Education Academy, UK, and can be reached via moshoke@yahoo.com; twitter: @moshoke
