Feeds

Apple slapped with iOS privacy lawsuit

'We respect your privacy' promise in dispute

Secure remote control for conventional and virtual desktops

Apple has been named in a class-action lawsuit alleging that the company allows iOS applications to provide advertisers with sensitive – and supposedly private – user information, according to Bloomberg Businessweek, which broke the story on Tuesday.

"Apple claims to review each application before offering it to users, purports to have implemented app privacy standards, and claims to have created 'strong privacy protections' for its customers," the complaint states. "However, Plaintiffs have discovered that some of these apps have been transmitting their personal, identifying information ('PII') to advertising networks without obtaining their consent."

The complaint goes on to allege that iOS devices' Unique Device Identifiers (UDIDs) are "being used by ad networks to track Plaintiff and the Class – including what apps they download, how frequently they use the apps, and for how long."

In addition, the complaint alleges that "Some apps are also selling additional information to ad networks, including users' location, age, gender, income, ethnicity, sexual orientation and political views."

The suit was filed in the US District Court of the Northern Disctrict of California, San José Division, by Jonathan Lalo of Los Angeles County. In addition to Apple, it names Backflip (publisher of Paper Toss, named in the suit), Dictionary.Com, Pandora, and The Weather Channel as codefendants.

The complaint cites Pandora Radio as a privacy-violating app, saying that it "sends age, gender, location, and UDIDs to a variety of third-party ad networks," all "without the prior consent of users, in violation of Apple's app rules, and a variety of state and federal laws."

To bolster its case, the complaint specifically mentions a recent Wall Street Journal investigation, which fingered Pandora and others as UDID abusers.

As The Reg reported in October, the WSJ is not alone in pointing out iOS UDID flaws: vulnerabilities were also identified in a research paper by Eric Smith of Bucknell University in Pennsylvania, which compared the iOS UDID vulnerability to the Pentium 3's Processor Serial Number system that embarrassed Intel in 1999.

The WSJ investigation, however, appears to have provided a substantial impetus to Lalo's complaint, noting as it does that: "Both the Android and iPhone versions of Pandora, a popular music app, sent age, gender, location and phone identifiers to various ad networks. iPhone and Android versions of a game called Paper Toss – players try to throw paper wads into a trash can – each sent the phone's ID number to at least five ad companies."

According to the complaint, the laws violated by UDID abuse include the US Computer Fraud and Abuse Act and Electronic Communications Privacy Act, plus California's Unfair Competition Law and Consumer Legal Renedies Act,

Apple did not respond to our email and phone requests for comment, but it should be noted that the company's App Store Review Guidelines state that "Apps cannot transmit data about a user without obtaining the user's prior permission and providing the user with access to information about how and where the data will be used."

Apple's iPhone Developer Program License Agreement is similarly stringent, instructing developers that:

You and the Application must comply with all applicable privacy and data collection laws and regulations with respect to any collection, transmission, maintenance, processing, use, etc. of the user's location data or personal information by the Application. In addition, the use of any personal information should be limited solely as necessary to provide services or functionality for Your Application (e.g., the use of collected personal information for telemarketing purposes is prohibited (unless expressly consented to by the user)). You and the Application must also take appropriate steps to protect any such location data or personal information from unauthorized disclosure or access.

From where we sit, it appears that either the WSJ investigation was wrong, Apple has been remiss in vetting apps from Pandora and others, or that there's a bit of sub rosa hanky-panky going on between Apple and some iOS developers when it comes to users' privacy.

One thing, however, is certain: The Reg will keep a close eye on case number 5:10-cv-05878-PSG, Lalo v. Apple, Inc et al. This dust-up is sure to become even more interesting. ®

Beginner's guide to SSL certificates

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?