Feeds

Apple slapped with iOS privacy lawsuit

'We respect your privacy' promise in dispute

Build a business case: developing custom apps

Apple has been named in a class-action lawsuit alleging that the company allows iOS applications to provide advertisers with sensitive – and supposedly private – user information, according to Bloomberg Businessweek, which broke the story on Tuesday.

"Apple claims to review each application before offering it to users, purports to have implemented app privacy standards, and claims to have created 'strong privacy protections' for its customers," the complaint states. "However, Plaintiffs have discovered that some of these apps have been transmitting their personal, identifying information ('PII') to advertising networks without obtaining their consent."

The complaint goes on to allege that iOS devices' Unique Device Identifiers (UDIDs) are "being used by ad networks to track Plaintiff and the Class – including what apps they download, how frequently they use the apps, and for how long."

In addition, the complaint alleges that "Some apps are also selling additional information to ad networks, including users' location, age, gender, income, ethnicity, sexual orientation and political views."

The suit was filed in the US District Court of the Northern Disctrict of California, San José Division, by Jonathan Lalo of Los Angeles County. In addition to Apple, it names Backflip (publisher of Paper Toss, named in the suit), Dictionary.Com, Pandora, and The Weather Channel as codefendants.

The complaint cites Pandora Radio as a privacy-violating app, saying that it "sends age, gender, location, and UDIDs to a variety of third-party ad networks," all "without the prior consent of users, in violation of Apple's app rules, and a variety of state and federal laws."

To bolster its case, the complaint specifically mentions a recent Wall Street Journal investigation, which fingered Pandora and others as UDID abusers.

As The Reg reported in October, the WSJ is not alone in pointing out iOS UDID flaws: vulnerabilities were also identified in a research paper by Eric Smith of Bucknell University in Pennsylvania, which compared the iOS UDID vulnerability to the Pentium 3's Processor Serial Number system that embarrassed Intel in 1999.

The WSJ investigation, however, appears to have provided a substantial impetus to Lalo's complaint, noting as it does that: "Both the Android and iPhone versions of Pandora, a popular music app, sent age, gender, location and phone identifiers to various ad networks. iPhone and Android versions of a game called Paper Toss – players try to throw paper wads into a trash can – each sent the phone's ID number to at least five ad companies."

According to the complaint, the laws violated by UDID abuse include the US Computer Fraud and Abuse Act and Electronic Communications Privacy Act, plus California's Unfair Competition Law and Consumer Legal Renedies Act,

Apple did not respond to our email and phone requests for comment, but it should be noted that the company's App Store Review Guidelines state that "Apps cannot transmit data about a user without obtaining the user's prior permission and providing the user with access to information about how and where the data will be used."

Apple's iPhone Developer Program License Agreement is similarly stringent, instructing developers that:

You and the Application must comply with all applicable privacy and data collection laws and regulations with respect to any collection, transmission, maintenance, processing, use, etc. of the user's location data or personal information by the Application. In addition, the use of any personal information should be limited solely as necessary to provide services or functionality for Your Application (e.g., the use of collected personal information for telemarketing purposes is prohibited (unless expressly consented to by the user)). You and the Application must also take appropriate steps to protect any such location data or personal information from unauthorized disclosure or access.

From where we sit, it appears that either the WSJ investigation was wrong, Apple has been remiss in vetting apps from Pandora and others, or that there's a bit of sub rosa hanky-panky going on between Apple and some iOS developers when it comes to users' privacy.

One thing, however, is certain: The Reg will keep a close eye on case number 5:10-cv-05878-PSG, Lalo v. Apple, Inc et al. This dust-up is sure to become even more interesting. ®

Endpoint data privacy in the cloud is easier than you think

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
Microsoft's Euro cloud darkens: US FEDS can dig into foreign servers
They're not emails, they're business records, says court
Plug and PREY: Hackers reprogram USB drives to silently infect PCs
BadUSB instructs gadget chips to inject key-presses, redirect net traffic and more
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
prev story

Whitepapers

7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?