Apple even tracks you with its own privacy protections, study finds

For all of Apple’s talk of privacy from your iPhone, the company sucks up a lot of data about you. iPhones have a privacy setting that is supposed to disable this tracking. According to a new report from independent researchers, Apple collects extremely detailed information about you with its own apps, even when you turn off tracking, an apparent direct contradiction to Apple’s own description of how privacy protection works.

The iPhone Analytics parameter makes an explicit promise. Disable it, and Apple says it will “disable Device Analytics Sharing completely.” However, Tommy Mysk and Talal Haj Bakry, two app developers and security researchers at software company Mysk, looked at data collected by a number of Apple’s iPhone apps: the App Store, Apple Music, Apple TV, Books and Stocks. . They found that the analytics control and other privacy settings had no obvious effect on Apple’s data collection. Tracking remained the same whether iPhone Analytics was enabled or disabled.

“The level of detail is shocking for a company like Apple,” Mysk told Gizmodo.

The App Store seemed to collect information about each a single thing you did in real time, including what you pressed, apps you searched for, ads you saw, and how long you watched a given app and how you found it . The app also sent details about you and your device, including identification numbers, the type of phone you use, your screen resolution, your keyboard languages, how you are connected to the internet , including the type of information commonly used. for device fingerprinting.

“Disabling or disabling customization options did not reduce the amount of detailed analytics sent by the app,” Mysk said. “I have opted out of all possible options, i.e. personalized ads, personalized recommendations, and sharing of usage data and analytics.”

Apple did not respond to multiple requests for comment. We will update the story with any information provided by the company.

Gizmodo asked Mysk to review a few other Apple apps for comparison. The researchers said the Health and Wallet apps, for example, don’t pass any analytics data whether the iPhone Analytics setting is on or off, while Apple Music, Apple TV, Books, iTunes Store, and Stocks all do. did. Most of the apps that sent analytics data shared consistent ID numbers, which would allow Apple to track your activity across all of its services, the researchers found.

For example, the Stocks app sent Apple your list of stocks watched, the names of the stocks you viewed or searched for and timestamps of when you did so, along with a record of all articles from press you see in the app, according to Mysk analysis. for Gizmodo. The information was sent to a web address called analytics, https://stocks-analytics-events.apple.com/analyticseventsv2/async. This transmission was separate from the iCloud communication needed to sync your data across all devices. Unlike other apps, however, Stocks sent different ID numbers and much less detailed device information.

The researchers checked their work on two different devices. First, they used a jailbroken iPhone running iOS 14.6, which allowed them to decipher the traffic and examine exactly what data was being sent. Apple introduced app tracking transparency in iOS 14.5, prompting users to decide whether or not to give their data to individual apps with the prompt “Ask app not to track?”

The researchers also looked at a regular iPhone running iOS 16, the latest operating system, which reinforced their findings. There’s little reason to think the jailbroken phone would send different data, they said, but on iOS 16 they saw the same apps sending similar data packets to the same Apple web addresses. The data was transmitted at the same time under the same circumstances, and activating and deactivating the available privacy settings also did not change anything. The researchers couldn’t examine exactly what data was sent because the phone’s encryption remained intact, but the similarities suggest this could be standard behavior on the iPhone.

Keeping an eye on your behavior rubs some people the wrong way, regardless of the information in question. But this data can be sensitive. In the App Store, for example, the fact that you’re looking at apps related to mental health, addiction, sexual orientation, and religion can reveal things you might not want sent to servers. of the company.

It’s impossible to know what Apple is doing with the data without the company’s own explanation, and as is so often the case, Apple has remained silent so far. It’s entirely possible that Apple won’t use the information if you turn off the settings, but that’s not how the company explains what the settings do in its privacy policy.

You can see what the data looks like for yourself in the video Mysk posted on Twitter, documenting the information collected by the App Store:

It’s not a situation where every app follows me, so what more. These results are not consistent with standard industry practices, Mysk says. He and his research partner have done similar tests in the past looking at analytics in Google Chrome and Microsoft Edge. In both of these applications, Mysk indicates that data is not sent when scan settings are disabled.

Privacy is one of the main issues that Apple uses to differentiate its products from its competitors. It sported 40ft billboards of the iPhone with the simple slogan “Privacy. It’s the iPhone. Internet privacy in the once sacrosanct Apple ecosystem Apple is working hard to build an advertising empire. Apple’s advertising network works on your personal information, just like Google and Meta’s, but in a more reserved way.

Along the way, Apple has developed a handy definition of what privacy means that allows the company to criticize rivals’ privacy practices while harvesting your data for similar purposes. Apple says you shouldn’t think of what it does as “tracking.” According to the company website:

Apple’s advertising platform does not track you, which means it does not link user or device data collected from our apps with user or device data collected from third parties for the purposes of targeted advertising or advertising measurement, and does not share user or device data with data brokers. .

In other words, it’s not tracking unless you link data collected from services owned by different companies. If only one company, Apple, collects the data, then by Apple’s definition there is no tracking. Of course, this is different from the definition of tracking that everyone seems to be using.

It’s no surprise that Apple collects analytics information, the practice is defined in the privacy policy, and almost every app and device you use is likely to use your data for analytics. But Mysk said he was stunned by the level of detail. “I expected a company like Apple, which believes privacy is a basic human right, to collect more generic analytics,” Mysk said.

What happens on your iPhone stays on your iPhone, unless you count the mountains of information your iPhone sends to Apple.