Some iPhone apps handing precise location data to as many as 40 businesses

Posted:
in iPhone edited December 2018
Despite Apple's strict controls on privacy, a number of iOS apps are not only tracking precise location information on anonymized users but sharing it with third-party businesses -- sometimes dozens of them, a report revealed on Monday.

Apple iPhone XS and XS Max


A particular problem was WeatherBug, which was found to be sharing exact latitude and longitude to 40 companies, the New York Times said. In its broader investigation the paper tested 20 iOS and Android apps, the majority of which had already been tagged by researchers and industry sources as potentially sharing location data. 17, including WeatherBug, were found to be sharing users' precise locations to about 70 businesses in all.

Apple requires data passed to advertisers and app developers be anonymized -- stripped of names and other identifiers -- in order to protect individuals. But, entities that collect location data can potentially infer who someone is based on context. The Times gave the example of a layperson who cooperated in the investigation, math teacher Lisa Magrin, the only subject who travels from her home to her middle school by one particular route each day.

Advertisers and researchers may not care about being that granular, but are often eager to know what communities, services, and products people are interested in. Developers in turn may be willing to sell that data as an alternative to putting pricetags on their apps.

Another implicated app was theScore, which was discovered sharing data to 16 advertising and location firms. The Times noted that like some of the other investigated apps theScore's developer was misleading, telling users only that granting location permissions would "recommend local teams and players that are relevant to you."

Similarly The Weather Channel, the most popular weather title on the App Store, tells people that sharing location information is meant for personalized forecasts. For a time however that data was also being analyzed for hedge funds by the IBM subsidiary that owns the app, the Weather Company.

The analysis was being done as part of a pilot program that has since ended. Until the Times talked to IBM though, the app's privacy policy didn't mention that the Weather Company might share aggregated location data for commercial purposes.

Today's report is likely to spur action by Apple, which -- except in China -- has made privacy a tentpole of user privacy, even getting into conflicts with the U.S. and Indian governments. CEO Tim Cook has suggested that U.S. privacy legislation is "inevitable," and lauded the European Union's General Data Protection Regulation.
«1

Comments

  • Reply 1 of 34
    Apple should suspend these apps from the App Store indefinitely!
    netmagekingofsomewherehotn2itivguynimpeachabletechStrangeDaysstanthemanSnickersMagoogilly33magman1979cornchip
  • Reply 2 of 34
    jdgazjdgaz Posts: 337member
    So did these folks "apps" violate the terms of service. If yes, tell us which ones. Give us a list. If they didn't violate the terms of service, then is it an issue?
    SolicornchipDeelron
  • Reply 3 of 34
    I have an app, Robinhood, that apprears to track my data with no way to turn it off in location services. When I travel and return home, when I swipe up on the app to close it, it will say “Welcome Home” on the bottom of the phone screen. Reported it to Apple but the behavior continues and there is nothing in location services that lets me turn it off. 
    stanthemancornchipwatto_cobrajony0
  • Reply 4 of 34
    Why on earth isn't there a simple on/off control for Location Services in the Control Center just like wi-fi, cellular, & bluetooth communications? Pet peeve.
    SnickersMagoocornchip
  • Reply 5 of 34
    maltzmaltz Posts: 117member
    bulk001 said:
    I have an app, Robinhood, that apprears to track my data with no way to turn it off in location services. When I travel and return home, when I swipe up on the app to close it, it will say “Welcome Home” on the bottom of the phone screen. Reported it to Apple but the behavior continues and there is nothing in location services that lets me turn it off. 
    It could be tracking you through conventional web tracking techniques, such as IP address location. It doesn't give them a specific location beyond city, but that, plus perhaps their being able to infer your "home" IP address due to frequency of use is plenty enough information for them to know you're traveling, roughly where you're traveling, and when you return home.
    cornchipDeelronwatto_cobra
  • Reply 6 of 34
    bulk001 said:
    I have an app, Robinhood, that apprears to track my data with no way to turn it off in location services. When I travel and return home, when I swipe up on the app to close it, it will say “Welcome Home” on the bottom of the phone screen. Reported it to Apple but the behavior continues and there is nothing in location services that lets me turn it off. 
    I'm under the impression that this is not possible, since app devs must use Apple APIs to gather location, which mandates that it is listed in the location services settings. I don't believe they have any other way to access GPS data. 

    As noted tho perhaps they're using some other way such as IP or wifi maps. 
    cornchipwatto_cobra
  • Reply 7 of 34
    Tip 'o the iceberg.  Google Maps tracking despite the user explicitly turning it off? No consequence. Oh, wait, they pay Apple 8 billion a year...we'll let that one go I guess ;)
  • Reply 8 of 34
    rcfarcfa Posts: 747member
    Why on earth isn't there a simple on/off control for Location Services in the Control Center just like wi-fi, cellular, & bluetooth communications? Pet peeve.
    Just because you don’t want ONE app to access your location, doesn’t mean another should not be able to access it.
    You can already turn access on or off on a per app basis.
    None of that fixes the issue at hand: app vendors passing on the data. You want to give location access to an app that provides the local weather, but you want that information used only for pulling the appropriate weather data, not to let third parties track you just because the weather app vendor thought that’s a lucrative side business.
    GeorgeBMacn2itivguywatto_cobra
  • Reply 9 of 34
    “Developers in turn may be willing to sell that data as an alternative to putting pricetags on their apps.” This is PRECISELY what no app should be allowed to do, or else Apple execs should stop saying they do not monetize user data. Allowing a third party to directly monetize personal data places Apple in the position of accomplice. Deceiving users about the practice means that Apple is obstructing the search for truth and the protection of privacy.
    bonobobcornchip
  • Reply 10 of 34
    irelandireland Posts: 17,528member
    gutengel said:
    Apple should suspend these apps from the App Store indefinitely!
    Suspend the devs.

    No apps should have access to user contacts either. Should be off limits to apps. There’s no way there should be an iOS OS-level feature where a user can share the private details of everyone they know with a simple “Ok” on their screen. I’d much rather devs have access to my location than my entire contact book—it’s insane. And  sacrosanct.
    edited December 2018 GeorgeBMacmagman1979cornchipminicoffee
  • Reply 11 of 34
    That is why I never keep location service on - only when I need it (Waze, some verification with bank e.t.c.) . Now I know it could be skipped, but then I can muffle and go off grid by turning phone off... or if this does not work switching to another one ;) What are you going to sell to me based on location in some police academy when I visit my law enforcement friends? Do you really need this data? So stay away.
    edited December 2018
  • Reply 12 of 34
    irelandireland Posts: 17,528member
    Tip 'o the iceberg.  Google Maps tracking despite the user explicitly turning it off? No consequence. Oh, wait, they pay Apple 8 billion a year...we'll let that one go I guess ;)
    True.
  • Reply 13 of 34
    That is why I never keep location service on - only when I need it (Waze, some verification with bank e.t.c.)

    I don't think it always help. I'm pretty sure some apps refresh in the background and use your IP address to determine your location. Combine that with internet tracking (cookies) and it becomes pretty hard to stay anonym as soon as you use Internet connected devices. VPN and incognito mode might help a Little.
    unbeliever2cornchip
  • Reply 14 of 34
    I just deleted Weatherbug.  I have no tolerance for lack of transparency regarding data acquisition and data sharing.  I encourage others to kill of Weathetbug
    watto_cobra
  • Reply 15 of 34
    rcfa said:
    Why on earth isn't there a simple on/off control for Location Services in the Control Center just like wi-fi, cellular, & bluetooth communications? Pet peeve.
    Just because you don’t want ONE app to access your location, doesn’t mean another should not be able to access it.
    You can already turn access on or off on a per app basis.
    Well, cellular data already has an overall switch in the Control Center as well as per-app switches, so there is precedent.
    i understand that it doesn't fix bad app behavior, but a simple, convenient way of denying all apps of location data unless needed could reduce the exposure window.
    i already severely limit location data access on a per-app basis.
    watto_cobra
  • Reply 16 of 34
    Tip 'o the iceberg.  Google Maps tracking despite the user explicitly turning it off? No consequence. Oh, wait, they pay Apple 8 billion a year...we'll let that one go I guess ;)
    Source?
    cornchipwatto_cobra
  • Reply 17 of 34
    “Developers in turn may be willing to sell that data as an alternative to putting pricetags on their apps.” This is PRECISELY what no app should be allowed to do, or else Apple execs should stop saying they do not monetize user data. Allowing a third party to directly monetize personal data places Apple in the position of accomplice. Deceiving users about the practice means that Apple is obstructing the search for truth and the protection of privacy.
    How is Apple deceiving users?
    n2itivguywatto_cobra
  • Reply 18 of 34
    Tip 'o the iceberg.  Google Maps tracking despite the user explicitly turning it off? No consequence. Oh, wait, they pay Apple 8 billion a year...we'll let that one go I guess ;)
    Source?
    http://fortune.com/2018/09/29/google-apple-safari-search-engine/
    https://mashable.com/article/google-location-history-tracking/#t.N.IrwCD5qn
  • Reply 19 of 34
    gutengel said:
    Apple should suspend these apps from the App Store indefinitely!

    Essentially, I assumed that ANY app that provided unlimited location services to (whether the app was open of not) was selling my location.    Maybe it would be better to force them to clearly describe in language easily understood exactly what they are sharing and to whom -- and to update the user if it changes.

    WeatherBug is one of my most heavily used apps and I would miss it greatly.
    I actually kind of liked the TheWeatherChannel better, but it doesn't run well on my 6+, so I stick with WeatherBug.

    Or too, these apps, could offer a purchase option or subscription to make up for lost advertising revenue.

    There are a number of options.


  • Reply 20 of 34
    croprcropr Posts: 883member
    The mobile operator knows the location of the mobile base station you connect to. So your location is known the moment you switch your smartphone on.

    If you are using standard wifi, your IP address defines the neighbourhood where you are located.

    So, any app developer can get a very good approximation of your location even if your location based service is switched off.   And he/she does not have to ask permission to Apple to use the information linked to your IP address.  He/she can get very detailed information about you (see https://www.maxmind.com for an example).

    Basically the "guarantee" that Apple gives you about your privacy, is for the location related data nothing but a marketing story.

    The only thing that would help if the app developer has to agree to a kind of GDPR regulation (like in the EU), where he/she must guarantee not to sell the location information to someone else. 
     

    muthuk_vanalingam
Sign In or Register to comment.