Accurately. The key word in there was "accurately".

The real key word is "legally". IP addresses + other metadata (browser fingerprinting and the like) can be enough to sufficiently identify an individual, or at least a household, for some purposes, such as making a more effective advertising profile.

Collecting the data based on IP would basically have the exact same legal status as doing it based on other identifiers. No browser is involved here, so no fingerprinting. And finally, Apple is not in the advertising business and has no need for advertising profiles.

Coulda woulda shoulda isn’t evidence.

I'm having trouble figuring out your meaning in this context. Care to explain?

There is no evidence Apple is storing any information collected via OCSP for advertising, or collecting metadata along with it. Effectively all they know is an IP address and a hash identifying a developer certificate that can correspond to any of dozens of apps.

How does "coulda woulda shoulda" mean that?

If IP addresses couldn't in some cases accurately track users, then it wouldn't be a priority to build a network that obscured them.

If they can only do it "in some cases", then they can't do it accurately, is the entire point. It can do it SOMETIMES.

Apple has more accurate information. They are not sending it. Why?

I think you might be confusing accuracy and reliability. But I'm not here to argue about semantics, you can use whatever definition of accuracy you want. IP addresses are large attack vector for deanonymization/tracking, and people should be thinking more about how IP addresses get leaked and in what contexts. Whatever definition of "accuracy" you want to use, I don't think that changes the overall point that IP addresses matter.

To your earlier comment:

> Why would you not interpret this charitably as them not actually trying to spy on you?

I fully agree with this. I think Apple's intention is not to spy on users, it's to A) stop malware, and B) exert more control over their ecosystem in general.

I have a problem with point B, but that's a separate conversation.

To your later point:

> It is not possible to accurately connect an identity with an IP address.

This is just plain wrong; it is possible to accurately connect identities to IP addresses, people do it all the time. Reliability is a separate conversation. If you're working off of a different definition of "accurate", then, whatever, I don't care. But I stand by the point that IP addresses are a privacy risk and that they can be used to track/identify users in the real world, I don't think that's a disputable fact.

The privacy worry here is twofold. First that these requests are (currently) sent in plaintext. To their credit, I think Apple is fixing that issue. Which is good, because plaintext payloads allow adversaries on the same network to potentially sniff which applications you're using.

The second privacy worry is that regardless of whether or not Apple is trying to spy on users, they still might be storing that data, and we only have their word to go on that it'll be stored in a protected way or deleted regularly. If a court order comes down asking Apple to reveal that information, or if it gets hacked, that data increases the threat model for Apple users.

An adversary with access to Apple's data (whether that adversary is a hacker or a government) could theoretically tie app usage to real-world identities if the IP addresses are logged, especially if they can match IP addresses with logging of other data being sent to Apple's servers. That's the point m463 is making in his original comment -- the data here doesn't just exist in isolation, it's IP addresses that an attacker could correlate with other real-world identifying information.