On 2022-11-12, badgolferman <
REMOVETHISb...@gmail.com> wrote:
> Apple is facing a class action lawsuit for allegedly harvesting iPhone
> user data even when the company’s own privacy settings promise not to.
> The suit, filed Thursday in California federal court, comes days after
> Gizmodo exclusively reported on research into how multiple iPhone apps
> send Apple analytics data, regardless of whether the iPhone Analytics
> privacy setting is turned on or off.
>
> The problem was spotted by two independent researchers at the software
> company Mysk, who found that the Apple App Store sends the company
> exhaustive information about nearly everything a user does in the app,
> despite a privacy setting, iPhone Analytics, which claims to “disable
> the sharing of Device Analytics altogether” when switched off. Gizmodo
> asked the researchers to run additional tests on other iPhone apps,
> including Apple Music, Apple TV, Books, and Stocks. The researchers
> found that the problem persists across most of Apple’s suite of
> built-in iPhone apps.
>
> The lawsuit accuses Apple of violating the California Invasion of
> Privacy Act. “Privacy is one of the main issues that Apple uses to set
> its products apart from competitors,” the plaintiff, Elliot Libman,
> said in the suit, which can be read on Bloomberg Law. “But Apple’s
> privacy guarantees are completely illusory.” The company has plastered
> billboards across the country with the slogan “Privacy. That’s
> iPhone.”
For those of us who are actually interested in honest discussion about
this, here are some excellent breakdowns of this weak lawsuit:
---
Apple is collecting data exactly how it says it is, while Mysk is using
clever wording to mislead and file a lawsuit.
Edit- “Ask not to track” means Apple isn't gonna share data with other
developers about other apps you use, etc. This cuts down on targeted ads
and helps prevent a company from building a profile on you.
Any app you log into can track you, Meaning the Facebook app can still
see everything you do on the app, they just can’t get data from Apple
about other apps and services you use.
It should also be noted that Google can totally break this, as when you
sign in on and use their apps and services they can track you and store
data on their servers, this allows them to build a profile on you.
This is also the difference in Google and Apple, Apple shares data in a
way that’s usually useless outside of app development, and developers
generally can’t track back.
Google however has a hand in the data collection at all levels so
regardless of Google shares that data or how it’s shared with them, they
can easily establish users. Which allows them to with or without your
permission build a user profile which Google uses to make money.
From the App Store terms of service,
b. Consent to Use of Data: You agree that Licensor may collect and use
technical data and related information including but not limited to
technical information about your device, system and application
software, and peripherals--that is gathered periodically to facilitate
the provision of software updates, product support, and other services
to you (if any) related to the Licensed Application. Licensor may use
this information, as long as it is in a form that does not personally
identify you, to improve its products or to provide services or
technologies to you.
Apple has always collected data, and has always been open about it.
Their privacy is in most cases they don’t know who you are or sell data
to 3rd parties or allow cross app tracking.
But let’s break it down even more,
From the article
The data being collected is quite detailed, too. As Gizmodo points out,
a user looking at the App Store app on their iPhone would have their
search data, what they tapped on, and how long they were checking out an
app all sent to Apple in real-time.
Yup. It’s fairly normal to track App Store usage. See above quote.
Using Apple's Stocks app? Apple will receive a list of the user's
watched stocks, any articles they read in-app, and the names of any
stocks they searched for. The timestamps for which a user viewed stock
information will be sent over too.
Yes, they are open about it also
<
https://www.apple.com/legal/privacy/data/en/stocks/>. Even going as far
as telling you how to reset the identifier.
Some of Apple's apps even collect detailed information about the user's
iPhone such as the model, screen resolution, and keyboard language.
Yup. As does any app such as Facebook or Google if you are signed in on
them.
According to the developers, attempts to turn this data collection off,
such as selecting the Settings option "disable the sharing of Device
Analytics altogether" did not affect the data from being sent.
And it won’t, Device Analytics shares ALL the data about the device with
Apple and not just Apple use you, it also doesn't prevent a 3rd party
app that uses a log in from collecting data.
Apple is collecting this data regardless of a user's settings where they
are given the option to turn data collection off, possibly giving them a
false sense of privacy.
No they aren't. Apple is collecting data in accordance with your
settings. It’s not their fault you didn't read TOS or the privacy
policy.
---
Another from a lawyer specializing in constitutional law:
---
I was one too in a former, more stressful, life, and the curiosity got
the better of me so I ended up reading the initial filing.
At best it seems to consist of a severe misunderstanding of the matters
at hand, at worst a conscious attempt to mislead. In either case I
expect it to be pointed out as soon as Apple files for summary
dismissal.
There are a bunch of issues with this case, not in the least that it’s
predicated on research done by Mysk on iOS 14.6. Mysk themselves remains
vague when asked if this also occurs on iOS 16.
More specifically they state:
<
https://twitter.com/mysk_co/status/1588308360897576960?s=46&t=ruYqGnu4s6HfkXxrUlE65Q>
It’s unclear if Apple Still collects analytics data in iOS 16, even when
sharing analytics and personalized recommendations are switched off.
Regardless, the App Store already knows a lot about our behavior and how
we explore apps.
Which in and of itself is a rather weird statement when you've
already set everything up for 14.6.
Edit: someone in the thread suggested they used a jailbroken iPhone. I
can’t find any statements by Mysk that this is the case and it seems
they they simply used a packet analyzer, but nevertheless, it might
still be brought up whether trivial or not.
When further pressed on this Mysk acts rather skittish and avoidant. If
it ever comes to it that they’ll be flown in to testify, this will one
of the first things that will be brought up spring cross examination.
Then there’s the matter of misrepresenting what the toggle promises. The
toggle is called “Share iPhone & Watch Analytics”, has a small explainer
that states:
Help Apple improve its products and services by automatically sending
daily diagnostic and usage data. Data may include location information.
Analytics uses wireless data. About Analytics & Privacy...
The link in that explainer leads to a section called “Device Analytics &
Privacy”, the text of which can be found here and states the following:
<
https://www.apple.com/legal/privacy/data/en/device-analytics/>
Device Analytics & Privacy Analytics is designed to protect your
information and enable you to choose what you share.
iOS Device Analytics
iPhone Analytics may include details about hardware and operating
system specifications, performance statistics, and data about how you
use your devices and applications. None of the collected information
identifies you personally. Personal data is either not logged at all,
is subject to privacy preserving techniques such as differential
privacy, or is removed from any reports before they’re sent to Apple.
You can review this information on your iOS device by going to
Settings > Privacy & Security > Analytics & Improvements and tapping
Analytics Data.
If you have consented to provide Apple with this information, and you
have Location Services turned on, the location of your devices may
also be sent to help Apple analyze performance issues (for example,
the strength or weakness of a mobile or Wi-Fi signal in a particular
location). This analytics location data may include locations such as
the location of your devices once per day, the location where a call
ends, or the location of a failed in-store transaction. You may choose
to disable Location Services for Analytics at any time. To do so, go
to Settings > Privacy & Security > Location Services > System Services
and tap to turn off iPhone Analytics.
If you agree to send Analytics information to Apple from multiple
devices that use the same iCloud account, we may correlate some usage
data about Apple apps across those devices by syncing using end-to-end
encryption. We do this in a manner that does not identify you to
Apple.
You may also choose to disable the sharing of Device Analytics
altogether. To do so, go to Settings > Privacy & Security > Analytics
& Improvements, and turn off Share iPhone Analytics. If you have an
Apple Watch paired with your iPhone, then tap to turn off Share iPhone
& Watch Analytics.
By using these features, you agree and consent to Apple’s and its
subsidiaries’ and agents’ transmission, collection, maintenance,
processing, and use of this information as described above.
At all times, information collected by Apple will be treated in
accordance with Apple’s Privacy Policy, which can be found at
www.apple.com/privacy
Published Date: September 12, 2022
A good lawyer might point out this is quite bit hidden away from the
toggle in question. But these champs decided to selectively quote from
this piece of text to give their claims some meat, so that option is out
the window.
They've also made the case for inference “[…]consumers reviewing Apple’s
privacy controls are left with the reasonable impression that […]”.
By introducing the text above and the notion of inference it’s easy to
argue that consumers can infer what is or isn't governed by the toggle
by simply looking at what data can be found under Settings > Privacy &
Security > Analytics & Improvements and tapping Analytics Data.
Hell, it’s not so much inference as the text telling you as much: “You
can review this information on your iOS device by going to Settings >
Privacy & Security > Analytics & Improvements and tapping Analytics
Data”.
It won’t surprise you that the offending data in question doesn't end up
in Settings > Privacy & Security > Analytics & Improvements > Analytics
Data.
Then there’s the matter that the toggle in question and the text
explaining what it does clearly gives the impression that this is about
analytical data of the device, as opposed to analytical data pertaining
ti specific apps.
It also doesn't help that “Device Analytics” is capitalized. I think you
know why.
There’s also the claim that this is about personally identifiable
private data, despite the research by Myst showing that it isn't and the
text explicitly stating as much: “None of the collected information
identifies you personally”.
They go on to suggest that their understanding is that it is private
identifiable data but that it is anonymized on Apple’s end, and thus too
late because the privacy has been breached. Whereas in actuality it is
not identifiable the moment it leaves the device.
In fact they go so far in their claim that it is personally identifiable
private data, that one of their causes of action (2nd count of 3) is a
violation of California’s eavesdropping law. Which has as element that
one eavesdrops on confidential communication, created for using spy gear
to listen in on private communications mind you.
While you’re catching your breath from laughing your ass of, give some
thought on how one would be eavesdropping on a communication to which
they themselves are the recipient.
Their first count is unjust enrichment based on the data Apple has
collected, but they've pretty much capped themselves there by
quantifying the value of personal information based on a study that
asked people to put a price on their personal information. Stating:
For example, in a study authored by Tim Morey, as early as 2011,
researchers studied the value that 180 internet consumers placed on
keeping personal data secure.6 Contact information was valued by the
study participants at approximately $4.20 per year. Demographic
information was valued at approximately $3.00 per year. But web
browsing histories were valued at a much higher rate: $52.00 per year.
Even if we ignore the issues with this unjust enrichment claim and the
study used to quantify the value and assume that they’re going to be
successful in this class action, those settlement check are going to be
worth little more than the paper they’re printed on.
They also drag in stuff like wiretapping laws, the complaint is honestly
good comedy if you have some time to kill.
The only thing that sort of sounds reasonable is California privacy
laws. Problem however is that privacy isn't defined as widely as say in
the EU, where unidentifiable information that leads to data
re-identification if it can be combined with other data is also
considered private data.
They’ll also have a hard time dealing with the fact that the App Store
can and does (via a separate stream, but nevertheless) collect private
data for legitimate business purposes such as processing transactions
and fraud prevention.
In any case, it’s a highly amusing piece of prose that I’d definitely
recommend reading if you have time to kill. I expect Apple’s GC to asses
what it would cost to litigate (if they don’t get a summary dismissal)
and settle if that turns out to be cheaper.
---