There's very real client-side protection: Do not have sleazy, add-supported apps installed, and - for what it's worth - keep your GPS and location services turned off except when explicitly needed.

It’s not clear if you believe all ad-supported apps are sleazy or if you think it’s clear to users when apps use precise geotargeted ads. Either way that doesn’t constitute “very real client-side protection” anymore than expecting folks to regularly disable basic functionality.

Better yet, don't use a smartphone when you care about your location being tracked.

Well, sure. If I'm ever going to go murder someone, I'll try to remember to leave it at home.

But I care some about it being tracked even when I'm not doing anything bad.

Well, OPSEC isn't all or nothing. And there's lots of other good advice.

There is a bit of an arms race between get a few $/c extra CPM by spoofing the geo location (the app needs to ask for this, and have reason to from App Store perspective, so not always available), and the data aggregators detecting said spoofing (all clients having the same geo / patterns in geo etc).

Reverse engineering will get you a PoC, but you can buy the cleansed data fairly easily (apparently..)

My phone (Android/LineageOS) blocks native ads too. There's adaway that does this nicely. Client-side protection exists.

The claim was not merely that client-side protection "exists." It was that ads are not a privacy issue any longer, implying a ubiquitous native solution, which is false.

It's great that some OSes are trying to solve it system-wide but host blocking isn't viable as ubiquitous protection against this attack. It would just break all ads all the time, which ultimately would make the platform untenable for ad-based apps. What you want is something like the machine-learning Intelligent Tracking Prevention that Safari just rolled out, but applied to native apps. That is non-trivial.

"It would just break all ads all the time"

Sounds like a feature not a bug.

Anyways I'm sure tech savvy folks who care about privacy and hate ads already have all the basic angles covered. I know I do!

also DNS66 helps