New reports from security researchers indicate that iOS sends your analytics data to Apple regardless of whether or not you agree to share, potentially causing massive privacy concerns.
Additionally, these same researchers have now provided data suggesting that Apple is capable of linking said data back to the user via linking IDs to users’ iCloud accounts.
Apple iOS Causes Privacy Concerns as Company Tracks Analytics Data
When a user first sets up an iPhone, they are asked if they want to share analytics data with Cupertino. Now, a report from Mysk states that Apple gets the data whether you agree to share it or not.
Spotted by 9to5Mac, a report from Gizmodo suggests that the App Store app sends real-time data based on app searches, ads viewed, how you found said apps and even the length of time spent look at the page for an app.
Additionally, this data can also be a sensitive to a user. As noted by Gizmodo, users that search for abortion or LGBTQIA+ apps will also have this information sent to Apple. While Mysk originally spotted this issue in an older version of iOS, it seems the issue may be extending to other apps.
To compound matters, Mysk additionally stated that this is an issue for other stock Apple apps. Digging deeper, Mysk found that Apple Music, Apple TV, Books and the Stocks app is sharing user information with Apple. As an example, Gizmodo mentions that the Stocks app shares what stocks you follow with Cupertino. The Stocks app will also view your search history.
Additionally, Mysk has shared a video providing more details.
Reports from 9to5mac indicate that this issue has brought about a class action lawsuit.
Further Issues
As mentioned by the report, Apple promises to keep your data anonymous, even if you agree to them collecting analytics data. Additionally, the report also reminds users that Apple does mention that the company may use your Apple ID to “correlate analytics data from all of the devices on which you granted consent, but again says that you cannot be identified.”
None of the collected information identifies you personally. Personal data is either not logged at all, is subject to privacy preserving techniques such as differential privacy, or is removed from any reports before they’re sent to Apple.
Users can review these policies again for themselves through Settings > Privacy & Security > Analytics & Improvements > About Analytics & Privacy.
While Apple maintains a philosophy focused on privacy, the work from Mysk seems to indicate this may not entirely be the case. According to the report, Mysk was able to capture data that goes directly to Apple, and made comparisons with it alongside data that identifies iCloud users via their Apple ID.
According to Mysk, analytics data for Apple features an ID known as “dsId”, or “Directory Services Identifier”. This ID is able to uniquely identify an iCloud account, and is how Apple is able to identify users through analytics data. According to Mysk, all analytics data sent to Apple features this dsId.
As noted by 9to5Mac, Apple touts privacy as a major part of its marketing strategy, and this seems like a failure to maintain said privacy at a rather massive level.
It’s an issue that Apple needs to address, and soon.
What do you think about Apple’s privacy issue? Let us know in the comments.