Over the past couple of years, Apple has focused its focus on user privacy. The iPhone maker has sparred with other Big Tech companies, most notably Facebook-owner Meta, about the issue. Apple’s efforts to protect users’ data have cost platforms like Facebook billions of dollars in revenue.
But, as it turns out, Apple has been collecting user data itself, even if their customers had explicitly changed their settings to stop the company from doing so. Now, Apple is being sued.
App developers and security researchers Tommy Mysk and Talal Haj Bakry from the software company Mysk recently found that iOS sends “every tap you make” to Apple from inside one of the company’s own apps. According to the developers, attempts to turn this data collection off, such as selecting the Settings option “disable the sharing of Device Analytics altogether” did not affect the data from being sent.
🧵
1/5
The recent changes that Apple has made to App Store ads should raise many #privacy concerns. It seems that the #AppStore app on iOS 14.6 sends every tap you make in the app to Apple.👇This data is sent in one request: (data usage & personalized ads are off)#CyberSecurity pic.twitter.com/1pYqdagi4e— Mysk 🇨🇦🇩🇪 (@mysk_co) November 3, 2022
The data being collected is quite detailed, too. As Gizmodo points out, a user looking at the App Store app on their iPhone would have their search data, what they tapped on, and how long they were checking out an app all sent to Apple in real-time. Using Apple’s Stocks app? Apple will receive a list of the user’s watched stocks, any articles they read in-app, and the names of any stocks they searched for. The timestamps for which a user viewed stock information will be sent over too. Some of Apple’s apps even collect detailed information about the user’s iPhone such as the model, screen resolution, and keyboard language.
Mysk conducted the test using a jailbroken iPhone running iOS 14.6. The team discovered similar iPhone activity with a non-jailbroken phone running iOS 16. However, due to encryption, Mysk could not determine exactly what data was being sent on the device using the latest operating system.
A class action lawsuit was filed on Thursday claiming that Apple’s actions violate the California Invasion of Privacy Act. The lawsuit does not focus so much on the fact that Apple is collecting this data. The suit hones in on Apple’s settings, such as “Allow Apps to Request to Track” and “Share Analytics,” that give users the perception that they can disable such tracking.
It shouldn’t be too surprising that Apple, or any tech company, collects user data. However, as the team at Mysk discovered, Apple is collecting this data regardless of a user’s settings where they are given the option to turn data collection off, possibly giving them a false sense of privacy.