The IT Nerd

The Washington Post has a story where they ran an experiment to see how private iPhones really are. And what they found was that when Background App Refresh is enabled, some iOS apps are using the feature to regularly send data to tracking companies. That data included phone numbers, email, location, IP address, and more:

On a recent Monday night, a dozen marketing companies, research firms and other personal data guzzlers got reports from my iPhone. At 11:43 p.m., a company called Amplitude learned my phone number, email and exact location. At 3:58 a.m., another called Appboy got a digital fingerprint of my phone. At 6:25 a.m., a tracker called Demdex received a way to identify my phone and sent back a list of other trackers to pair up with.

Apps that were found to be gathering up your data included Microsoft OneDrive, Mint, Nike, Spotify, The Weather Channel, DoorDash, Yelp, Citizen, and ironically The Washington Post’s own iOS app. Which is likely embarrassing for The Washington Post.

But let’s get to the point. Not all data collection is bad, such as when it’s anonymized and stored for a limited period of time, but some trackers are collecting specific user information and don’t provide clear information on how long that data is stored nor who it’s shared with. Thus there needs to be much visibility on that front. But in the absence of that, if you’re on Team iPhone and you’re concerned about the data apps are sending you can turn off Background App Refresh in the Settings app.

Finally, there’s Apple. What do they have to say about this seeing as they make a big deal of “what happens on your iPhone stays on your iPhone?” Well, besides the fact that this statement is clearly misleading at best based on what The Washington Post found, they gave a standard response:

At Apple we do a great deal to help users keep their data private,” the company says in a statement. “Apple hardware and software are designed to provide advanced security and privacy at every level of the system.” 

For the data and services that apps create on their own, our App Store Guidelines require developers to have clearly posted privacy policies and to ask users for permission to collect data before doing so. When we learn that apps have not followed our Guidelines in these areas, we either make apps change their practice or keep those apps from being on the store,

Based on what The Washington Post found, they’re not doing what the above statement says that they should be doing. #Fail.

This entry was posted on May 29, 2019 at 8:18 am and is filed under Commentary with tags Apple. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.