Buried in the privacy menu of every iPhone is a single switch that governs whether apps can follow a person’s activity across other companies’ apps and websites. It is called App Tracking Transparency, and when it is left in its permissive state, an app can request access to a device identifier that advertisers and data brokers use to stitch together a profile of what someone reads, buys, and browses. Turning it off takes only a few taps, yet many owners never touch it.
The setting matters because the tracking it enables is largely invisible. There is no obvious signal when an app hands off behavioral data to a third-party ad network, and the profiles built from that data can persist for years. Understanding what the toggle actually controls, and how to change it, puts a meaningful lever back in the hands of the person holding the phone.
What the advertising identifier actually exposes
At the center of the system is a string of characters known as the IDFA, or Identifier for Advertisers. As the Electronic Frontier Foundation explains in its guide to disabling ad-ID tracking, this identifier acts as a key that lets advertisers and data brokers link a person’s behavior across otherwise unrelated apps, making it far easier to track and profile them. Because the same identifier is available to many apps, it becomes the thread that ties disparate activity to one device.
That thread is valuable precisely because it is durable and consistent. Where cookies in a web browser can be cleared, a persistent device identifier follows the phone from app to app, letting companies recognize the same user across a shopping app, a game, and a news reader without ever knowing the person’s name. The result is a detailed behavioral portrait assembled quietly in the background.
How App Tracking Transparency changed the rules
Apple introduced App Tracking Transparency to force that hidden exchange into the open. According to a reference explainer on the framework, the system is an opt-in model that requires apps to ask permission before tracking a user, a requirement rolled out with iOS 14 and enforced beginning with iOS 14.5. Before that change, an app could reach for the advertising identifier without asking; afterward, it had to display the now-familiar prompt requesting permission to track.
The framework does not merely add a pop-up, though. When a user declines, or when the master setting is switched off, the app is denied access to the advertising identifier entirely, cutting the cross-app link at its source rather than politely asking advertisers to behave.
The two ways to shut tracking down
Apple’s own documentation lays out both the per-app control and the blanket option. In its support guidance on app tracking requests, the company describes how to open Settings, choose Privacy & Security, and select Tracking to review the list of apps that have asked to track and toggle any of them off individually. That same screen holds the more decisive switch.
Turning off “Allow Apps to Request to Track” at the top of that menu changes the default for everything. With it disabled, apps stop showing the tracking prompt altogether, and every app that would have asked is automatically treated as if the user had chosen “Ask App Not to Track.” In effect, one toggle answers the question no for all current and future apps at once, which is why it is often the single most efficient privacy step an iPhone owner can take.
What flipping the switch does and does not do
Disabling tracking meaningfully narrows the data pipeline, but it is not a cloak of invisibility. A 2026 walkthrough of iPhone tracking settings notes that while turning the setting off makes it substantially harder for advertisers and data brokers to build a cross-app profile, it does not stop every form of data collection. First-party data an app gathers about its own users, and information tied to a signed-in account, sits outside the reach of this particular control.
Ads themselves also do not disappear. What changes is their targeting: without the shared identifier, the ads a person sees become less tailored to inferred interests, and the behavioral dossier that fuels retargeting gets far harder to assemble. For most people the trade-off is one-directional, since the setting costs nothing in functionality while removing a channel that exists only to serve advertisers.
Because the control lives in a menu few visitors ever open, the practical takeaway is simply to open it. A minute spent in Privacy & Security, flipping the master tracking switch off, closes a door that was left ajar by default, and it applies immediately to the apps already installed as well as any downloaded later.
This article was researched and drafted with the assistance of AI and reviewed before publication.
More from Morning Overview
- A skeleton under Petra’s Treasury was found gripping a chalice that looks like the Holy Grail
- Two Ford recalls now carry a rare “do not drive” warning, so owners should check their VIN.
- A Colorado wildfire has exploded past 87,000 acres with no containment
- A wildfire near Ouray swelled past 18,000 acres, putting Colorado towns on alert
