Google to app developers: iOS 9 privacy feature that forces HTTPS can break ads, so add an exception to allow ads to be delivered over HTTP
Google Tells Developers How to Get Around Apple's New Security Rules So They Can Keep Selling Ads — Apple says it cares a lot about privacy.
Context & Ripple Effects
In 2015, Apple's App Transport Security rule forced app connections onto HTTPS by default, and Google's response was to tell developers how to opt out: add an exception so ads keep flowing over unencrypted HTTP. It's the opening move in what becomes a running pattern — Google documenting workarounds and impact assessments every time Apple tightens platform privacy, from this ATS advice through the AdMob guidance for iOS 14 (AdMob's iOS 14 Help Center update) and its breakdown of how IDFA restrictions would hurt install measurement and bidding (Google's IDFA impact analysis).
The stakes are structural: Apple controls the OS and the App Store, Google monetizes much of the ad inventory inside third-party apps on that OS. Weeks after this advice ran, Apple removed apps like Been Choice that had installed root certificates to block in-app advertising (Apple's purge of root-certificate ad blockers) — evidence it polices both sides of the line.
First-order effects
- App developers face an immediate trade-off: follow Google's exception guidance and keep ad revenue over HTTP, or stay fully compliant with Apple's HTTPS mandate and risk broken ad fills.
- Ad networks serving inventory into iOS apps — Google's network chief among them — have their delivery paths carved out of Apple's security perimeter, leaving that traffic unencrypted where the rest of the app isn't.
Second-order effects
- Apple's enforcement posture hardens on both fronts — forcing encryption while removing apps that circumvent its ad environment — which pushes Google toward documented compliance playbooks rather than silent exceptions, the approach visible later in its AdMob iOS 14 preparations.
- Each Apple privacy lever (ATS, then ATT and IDFA) forces Google to re-engineer measurement and bidding, with reporting by early 2021 that its ATT-matching plans were delayed over fears of shrinking mobile ad revenue (Google's delayed ATT response).
Third-order effects
- If the pattern holds, platform owners dictate privacy terms while ad intermediaries absorb the cost of compliance — a power asymmetry that recurs across every iOS privacy cycle and shapes how much visibility ad networks retain into installs, bids, and user identity.
- Developers become the shock absorber: caught between an OS vendor mandating security and an ad supplier asking for exceptions, they bear both the technical debt and the revenue risk each time the rules move.
The trend: Mobile OS privacy mandates are becoming the binding constraint on third-party ad networks, with Google repeatedly re-fitting its ad stack to whatever Apple ships next.