Google to app developers: iOS 9 privacy feature that forces HTTPS can break ads, so add an exception to allow ads to be delivered over HTTP
Mark Bergen / Re/code :
Context & Ripple Effects
iOS 9 introduces App Transport Security, which forces apps onto HTTPS — and Google's guidance to developers is a workaround, not a fix: add an exception so ad SDKs can keep serving creatives over plain HTTP. The advice exposes how much of the mobile ad stack still runs unencrypted behind the app shell.
It is also the opening move in a longer arc: five years later Google was updating its AdMob documentation to adopt Apple's ATT API for the IDFA opt-in prompt, and by early 2021 it had detailed how Apple's IDFA changes would cut install-metric visibility and affect bidding. The 2015 exception is the same collision — Apple tightening the platform, Google's ad business adapting around it.
First-order effects
- App developers face an immediate choice between adding an ATS exception (keeping ads live but shipping unencrypted traffic) or risking broken ad delivery and lost revenue on iOS 9 devices.
- Ad networks whose SDKs serve over HTTP are directly implicated: their tags now require per-app exemptions rather than working by default.
Second-order effects
- Apple's default-on security setting shifts remediation work onto thousands of individual apps instead of ad networks, fragmenting compliance and making each developer carry the privacy risk.
- The episode pressures Google's ad SDK ecosystem toward HTTPS support, since relying on developer-added exceptions does not scale as Apple tightens defaults.
Third-order effects
- If the pattern holds, each successive Apple privacy layer — transport encryption here, later the IDFA restrictions covered in the related reporting — erodes the data and delivery assumptions underlying mobile advertising, forcing platforms like Google to rebuild measurement and bidding on Apple's terms.
The trend: Apple is using platform-level privacy defaults to force Google's mobile ad stack into repeated retrofits, from HTTPS exemptions to ATT-era identifier limits.