Apple’s privacy page boldly claims that their apps mind their business and not that of iOS users, but new research has uncovered that the company is collecting user data without permission, raising widespread scepticism.
According to security researchers Tommy Mysk and Tala Haj Bakry, iPhones are collecting more personal data than users were led to believe.
On November 20, Mysk and Bakry published a series of findings on “Directory Services Identifier” (DSID for short). When iOS users set up their iPhones for the first time, Apple asks if we want to share analytics data with the company to help them “improve and develop its products and services.”
“None of the collected information identifies you personally. Personal data is not logged at all, is subject to privacy preserving techniques such as differential privacy, or is removed from any reports before they’re sent to Apple,” the company states before users consent to this.
Thereafter, they are given a DSID. However, the researchers’ team disagrees.
They claim that the DSID Apple assigned to users’ iCloud accounts does contain personally identifiable information — including people’s names, emails, and “any data in your iCloud account.” One of the tweets shows a screenshot of an application programming interface (API) connecting to iCloud with someone’s DSID “clearly seen alongside a user’s personal data.”
“Apple states in their Device Analytics & Privacy statement that the collected data does not identify you personally. This is inaccurate,” Mysk tweeted.
“The Appstore keeps sending detailed analytics to Apple even when sharing analytics is switched off,” he wrote and added that this data also contains an ID called “DSLD.”
Although initially unsure whether it is the same as the DSID, the ID that uniquely identifies an iCloud account, they later confirmed that they were the same ID.
Despite being a vocal supporter of user privacy, Apple rarely speaks up when their murky privacy claims get called into question.
As for people getting jittery about the sharing of their analytics data, there is not much for them to do until another multinational tech company arises, promising top-notch privacy protection.
