Feeds

Apple slapped with iOS privacy lawsuit

'We respect your privacy' promise in dispute

3 Big data security analytics techniques

Apple has been named in a class-action lawsuit alleging that the company allows iOS applications to provide advertisers with sensitive – and supposedly private – user information, according to Bloomberg Businessweek, which broke the story on Tuesday.

"Apple claims to review each application before offering it to users, purports to have implemented app privacy standards, and claims to have created 'strong privacy protections' for its customers," the complaint states. "However, Plaintiffs have discovered that some of these apps have been transmitting their personal, identifying information ('PII') to advertising networks without obtaining their consent."

The complaint goes on to allege that iOS devices' Unique Device Identifiers (UDIDs) are "being used by ad networks to track Plaintiff and the Class – including what apps they download, how frequently they use the apps, and for how long."

In addition, the complaint alleges that "Some apps are also selling additional information to ad networks, including users' location, age, gender, income, ethnicity, sexual orientation and political views."

The suit was filed in the US District Court of the Northern Disctrict of California, San José Division, by Jonathan Lalo of Los Angeles County. In addition to Apple, it names Backflip (publisher of Paper Toss, named in the suit), Dictionary.Com, Pandora, and The Weather Channel as codefendants.

The complaint cites Pandora Radio as a privacy-violating app, saying that it "sends age, gender, location, and UDIDs to a variety of third-party ad networks," all "without the prior consent of users, in violation of Apple's app rules, and a variety of state and federal laws."

To bolster its case, the complaint specifically mentions a recent Wall Street Journal investigation, which fingered Pandora and others as UDID abusers.

As The Reg reported in October, the WSJ is not alone in pointing out iOS UDID flaws: vulnerabilities were also identified in a research paper by Eric Smith of Bucknell University in Pennsylvania, which compared the iOS UDID vulnerability to the Pentium 3's Processor Serial Number system that embarrassed Intel in 1999.

The WSJ investigation, however, appears to have provided a substantial impetus to Lalo's complaint, noting as it does that: "Both the Android and iPhone versions of Pandora, a popular music app, sent age, gender, location and phone identifiers to various ad networks. iPhone and Android versions of a game called Paper Toss – players try to throw paper wads into a trash can – each sent the phone's ID number to at least five ad companies."

According to the complaint, the laws violated by UDID abuse include the US Computer Fraud and Abuse Act and Electronic Communications Privacy Act, plus California's Unfair Competition Law and Consumer Legal Renedies Act,

Apple did not respond to our email and phone requests for comment, but it should be noted that the company's App Store Review Guidelines state that "Apps cannot transmit data about a user without obtaining the user's prior permission and providing the user with access to information about how and where the data will be used."

Apple's iPhone Developer Program License Agreement is similarly stringent, instructing developers that:

You and the Application must comply with all applicable privacy and data collection laws and regulations with respect to any collection, transmission, maintenance, processing, use, etc. of the user's location data or personal information by the Application. In addition, the use of any personal information should be limited solely as necessary to provide services or functionality for Your Application (e.g., the use of collected personal information for telemarketing purposes is prohibited (unless expressly consented to by the user)). You and the Application must also take appropriate steps to protect any such location data or personal information from unauthorized disclosure or access.

From where we sit, it appears that either the WSJ investigation was wrong, Apple has been remiss in vetting apps from Pandora and others, or that there's a bit of sub rosa hanky-panky going on between Apple and some iOS developers when it comes to users' privacy.

One thing, however, is certain: The Reg will keep a close eye on case number 5:10-cv-05878-PSG, Lalo v. Apple, Inc et al. This dust-up is sure to become even more interesting. ®

3 Big data security analytics techniques

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.