How to prepare for Apple's privacy changes

[TomMonaghan]

Hey folks,

So the iOS 15 changes are out in the wild and I thought it was best to start a fresh thread to give everyone a place to ask questions, help each other, and share their experiences.

Thanks,

Tom Monaghan

Director of Product for Email

[TomMonaghan · Accepted solution]

Some thoughts on how to think about Suppression in an Apple Mail Privacy Protection world.

First off, thanks for all of your comments, questions and participation in this thread.  We appreciate your input and feedback about this change from Apple.

In 2016 we added Sends Since Last Engagement (SSLE) and its related feature, Graymail Suppression, in an attempt to make a task that had been very difficult for most folks, that is list hygiene, much easier.  While neither feature was perfect, they did accomplish what we set out to do.

As you might expect, Apple’s Mail Privacy Protection has changed the way these features work, but probably not in the way you expect.  In this post I’m going to share some more details on how things work and what changes we’re going to make in the product.

A little bit about Bot Filtering.

There are security vendors who primarily play in the enterprise space that have been doing this “open every email and click every link” thing for a while now.  In fact, we’ve had an option to filter these so called “Bot Opens” in your portal’s settings since 2017 and it’s been defaulted to on for as long as I’ve known (see: Tracking & Analytics > Advanced Tracking and find the checkbox for “Bot filtering”).

Well as it turns out, our system is good, maybe too good, and it is correctly categorizing Apple iOS 15 opens as if they were from bots (because they are) and filtering them out automatically if you have this feature enabled.  Note: for Apple iOS 15 events, this does not filter clicks, unsubscribes, or spam reports, only opens.  While this prevents all the “false” opens from skewing your results, it also prevents you from having complete results.  

Here’s a simple example:  Presently about 10% of the traffic we’re seeing is being opened with Apple iOS 15 devices.  So if you send to 1,000 recipients and have Bot Filtering enabled, you’ll only see opens from about 900 recipients - all of the folks who are not using Apple iOS 15 devices with Mail Privacy Protection enabled.  But we do not actively remove sent events, so in effect, your open rate, in this example will actually appear to go down over time, though we believe the true activity has not changed.

So what happens if you enable check “Suppress my unengaged contacts” when you send?

If you have Bot Filtering enabled and suppress unengaged contacts, our system will not know if the contacts opening on an iOS 15 device are actually opening your mail.  In this case, after 14 messages, if there are no clicks or opens on other device types, and if this Bot filtering checkbox remains checked, our system will suppress contacts that may actually be engaging with Apple iOS 15 devices.

What if you don’t enable Bot Filtering in your portal?

If Bot Filtering is disabled in your HubSpot portal, our systems will report any open that we see from Apple’s Mail Privacy Protection system as a normal open.  The challenge in this case is that we will be unable to distinguish between a “true” open where the person actually opened your email and a “false” open where Apple is doing the opening on their behalf and then serving up the content from Apple’s own servers if and when that person decides to open the email.  In either case, the events look exactly the same, though there do seem to be some edge cases that I won’t exhaustively go into here.

So what should you do?

This is honestly a tough question to answer and it depends on what you’re trying to optimize for. Each has risks and potential unintended consequences.  Proceed with caution and care.

If you’re trying to optimize for list size and are not worried about triggering automations with lists filled with contacts that are added due to opens that might not be real, then you can periodically shut off Bot Filtering and deselect Suppress unengaged contacts when you’re emailing.  This will allow you to recapture those Apple iOS 15 opens for any send that occurs when the bot filtering setting is disabled.  So when Apple does their Mail Privacy Protection thing, you’ll receive the opens for contacts who would have otherwise been captured by our bot filtering and shown as unengaged.  But keep in mind, you will get all of the Apple folks who are not actually opening too.  As I said above, proceed with caution!

If you really want to make sure that you have very high confidence that those opens are truly opens, leave your Bot Filtering on and continue to suppress your unengaged contacts but really drive towards clicks as a new form of engagement.  Find reasons for anything from social likes to upvotes, or article views or regular old CTAs, but get those clicks!  Even if they are on iOS 15 with Mail Privacy Protection, we’ll know there’s an open when we see the click.

What is HubSpot going to do?

We’re continuing to work on filtering and identification systems for bots and other non-human opens.  We’re also working on different reporting filtering options to enable you to better understand what is happening with your data.  We understand that right now this is not easy and we are working to make it better.  Finally, we’re working on other ways to measure engagement that are not just opens.  While opens were certainly great, their time has passed.  They’ve long since been a directional metric at best, but now, they’re really just not all that accurate. 

[RWaldrip]

Hi Tom - thank you for your response-- wanted to specifically ask about the portion quoted below about the bot 'clicks'-- is there any way to filter this false behavior in addition to the false opens behavior to keep it from muddying the data? We've found a lot of contacts recently that seem to be 'highly engaged' - clicking content in our emails, 'visiting the site', etc. that we suspect is just bot security link checks. What's the best way to deal with this in addition to the false opens? Appreciate the active participation in the HS community on this!

---

@TomMonaghan wrote:

A little bit about Bot Filtering.

There are security vendors who primarily play in the enterprise space that have been doing this “open every email and click every link” thing for a while now.  In fact, we’ve had an option to filter these so called “Bot Opens” in your portal’s settings since 2017 and it’s been defaulted to on for as long as I’ve known (see: Tracking & Analytics > Advanced Tracking and find the checkbox for “Bot filtering”).

[KMcAfee]

Is someone from HubSpot going to respond about this concern? @TomMonaghan 

[Lmiahhh]

Could HubSpot potentially filter data by email client? I feel like that would be our best bet initially to help filter out some of the false positives. For example, look at email open rates for Apple Mail pre and post update and compare them. Also, if a user becomes engaged for the first time in a long time, but uses Apple Mail, maybe designate that somehow. Just some of my thoughts!

[webmikepdx]

In addition to filters like "Email open was last using Apple Mail", or "Contact has ever opened with Apple Mail" etc., Hubspot could also work in the way the way Refine by Date is included in some filters.

[MMArketing5]

@Lmiahhh This will not work because you can have an IPhone and connect your Gmail account, etc and it will count as an apple client. It will affect every client including yahoo, outlook, Gmail. 

[BMulder]

Agreed! Would love for there to be a contact property that indicates the email client most recently used by a contact

[TerryB]

@TomMonaghan please can Hubspot consider @KMcAfee's question and advise us what the plans are around unengaged contacts.

Like many others who have upvoted @KMcAfee's message this is going to start impacting serveral businesses that use Hubspot.

[elanashama]

Thank you @dschwarz for the amazing post and all the info. Was really awesome. 

@KMcAfee , was wondering the exact same thing regarding unengaged contacts.

Any ideas/suggestions on how to tackle this?