Except if they weren't subject to App Store rules they would likely bypass the advertising ID and do their own fingerprinting instead.

You're logged into the app. They don't need to fingerprint anything.

Maybe in the Facebook app, but not necessarily in the Facebook SDK which is integrated by other apps for ads/auth/analytics.

SDK abilities don’t depend on the storefront, that’s up to the OS. Apple store is just informational.

Either way users should be able to choose what they install and from where.

All apps on iOS need to pass App Store review, which means all apps that integrate third-party SDKs need to ensure those SDKs don't violate App Store policies, including policies on fingerprinting. Apple has already started to deny approval of apps using third-party SDKs that violate user tracking policies on iOS 14.

You can do your own without dealing with SDKs.

This isn't a problem if Apple ups their game and actually competes to keep people on the App store despite having real choice.

Of course you can. You're entirely missing the point, which is that without a review process that sets explicit limits for how data can be used, developers will abuse system APIs to violate user privacy.

So be more strict with system APIs?

We can go back and forth forever with what-ifs. It's nothing we cant overcome in the future.

Restricting APIs doesn't solve the problem because there are plenty of APIs that apps need for legitimate purposes but can be abused by bad actors. Many of the APIs used for device fingerprinting would fall under this category.

Apps on the app store already do this.

There's a difference between sneaking through App Store review and not enforcing anything at all. People still shoplift even though theft is a crime, that's not an argument against having laws.

No. Apple provides a door (advertising ID) but there's also a window (fingerprinting). Right now both things exist. Apps already have the ability to fingerprint users with data they collect and that's not sneaky.

That's a strange argument though. Apple forks over an advertising ID so that any app can fingerprint you with a single system call yet you complain that more apps might in the future fingerprint you themselves.

The difference is the advertising ID can be disabled or reset by the user, and Apple has started blocking apps that use fingerprinting SDKs during app review. (https://9to5mac.com/2021/04/01/app-store-now-rejecting-apps-...)

Without app review there would be no practical way for end users to avoid fingerprinting.

> That's a strange argument though.

Only if you don't consider consent. A user opting-in and enabling the advertising ID is very different from a bunch of apps using third-party SDKs to fingerprint their device without asking.