Apple cracking down on applications that send location data to third-parties

https://9to5mac.com/2018/05/08/apple-location-apps-third-parties/

by john58 • 8 years ago

381 122 8 years ago

dep_b2• 8 years ago

I'm working for years as a developer building iOS applications. Apple got so strict the last months maybe last year it's just incredible. Lots of questions about monetization and background services, they really want you to have a solid business case for background location or just don't use it.

As a consumer I'm happy they take those steps though. My privacy is worth money. Either somebody sells it and gives me a "free" OS or somebody sells me an OS and I don't "sell" my privacy.

EADGBE• 8 years ago

They're positioning themselves to this space. It was interesting in the sense that it never was really marketed this way (by Apple); it was just the remainder product that didn't sell out your information.

It's always good to sell a "feature" you've always had which costs you nothing.

maire• 8 years ago

Apple always took location privacy seriously. I remember an interview between Steve Jobs and Walt Mossberg years ago on this subject. I looked it up again: https://www.youtube.com/watch?v=39iKLwlUqBo

Fradow2• 8 years ago

Do you know if they need a solid business case even if it is optional? For example, any idea if an optional "locate your device" feature would get shot down?

dep_b2• 8 years ago

Yes. I had a location tracking feature that would total your mileage automatically and submit it after your ride to your bookkeeper (this is mandatory for lease cars in some countries). I really had to explain that the app also might be backgrounded because people probably would be using Apple Maps to navigate while this thing was clocking away in the background

nsgi• 8 years ago

No idea if this is Apple's policy, but I would expect apps to follow UNIX philosophy. "Locate your device" should really be a separate app rather than a fringe feature of a fart app.

stcredzero• 8 years ago

they really want you to have a solid business case for background location or just don't use it.

I did notice that it was being used a lot, and it seemed like I had much worse battery life when using certain apps.

photojosh• 8 years ago

You can specify you want different precision in location. If you just want rough location, you'll get notified if you change location based on WiFi or cell tower switch. This uses next to no extra battery power and is sufficient for many background applications.

If you want exact location, then you'll be running the GPS, which indeed uses more battery. But even so, it's not that bad. I record detailed GPS for my runs quite often with a fitness app, and it only uses 5-7% battery an hour. (Key is to make sure it's not also hitting a data connection to download maps, and that the screen is off.)

hiram112• 8 years ago

Either somebody sells it and gives me a "free" OS or somebody sells me an OS and I don't "sell" my privacy.

Don't forget the Windows 10 model: You're forced to buy the OEM version on any new PC, and then you still get your privacy sold by MS.

nimbix• 8 years ago

The last time I checked it was still possible to buy a computer without Windows, as well as buy Windows that can be transferred between machines. Most people just don't bother with that.

mygo• 8 years ago

well in addition to privacy concerns, location tracking is a huge drain on the battery. And a good battery life is one of their selling points so I wouldn’t be surprised if during part of the review process some reviewers might hold the opinion that there better be a good reason why your app is using so much juice in the background.

mariodiana• 8 years ago

I was on the phone with Apple once, arguing about why the iOS app I put together at work shouldn't be rejected for running location services all the time. The point the representative at Apple made was that something like that needs to be primarily for the user's benefit, as opposed to it being primarily for the benefit of the people behind the app. I was able to demonstrate that to them, and the app was approved.

Apple is about apps being for the benefit of the user.

sizzle• 8 years ago

Wow I might just have to turn in my Android phone. I've been using Android since the G1 flagship phone. I value privacy the older I get.

flukus• 8 years ago

Either somebody sells it and gives me a "free" OS or somebody sells me an OS and I don't "sell" my privacy

Linux desktops show a viable 3rd option, they are free, libre and protect your privacy (usually). The also provide the halfway point I want between the iOS model and the android model the provide a set of core well vetted apps from the store and allow me to install whatever else I want.

Librem or whoever makes a mobile equivalent the linux desktop can't come soon enough.

billabul• 8 years ago

you would be surprised how many apps include analytics and gather in app usage data.

gepeto423• 8 years ago

They need to be much more aggressive towards apps that request access to the SSID of the current network. This is supposed to be limited, but in my experience, apps you would not expect to be doing that are doing it, and it's basically the same thing as location data.

saagarjha• 8 years ago

Limited? This is public and unrestricted API, to my knowledge: https://developer.apple.com/documentation/systemconfiguratio...

gepeto423• 8 years ago

Yeah, it was supposed to be - https://developer.apple.com/documentation/networkextension/n...

Around iOS 9, Apple deprecated some of the Captive Portal APIs, then re-instated them, a lot of changes that went back and forth, but my conclusion is that today, years later, way too many apps seem to read my SSID. Doesn't really matter how they do it, but I wish there was a prompt for it and no way for an app to directly fetch it.

throwaway0803832• 8 years ago

A few years ago, the FTC fined InMobi for doing precisely this: https://www.ftc.gov/news-events/blogs/business-blog/2016/06/...

AznHisoka• 8 years ago

Does this include apps like Foursquare/Swarm that sell aggregated location data to hedge funds? [1]

...or are the big players exempt from the rules of the game?

[1] https://www.entrepreneur.com/article/290543

bob_theslob646• 8 years ago

This is another article that talks about how they actually do what the parent comment talks about.

When someone checks in to a place on Swarm, Foursquare's newer app, the company records the user's coordinates, helping it determine all the different coordinates associated with a single business or other place.
Foursquare says it can't disclose who its partners are, or how many different smartphone users' data it has acquired. But Rosenblatt says the company could, for example, create a list of "millions" of smartphone owners who frequently visit fast food restaurants by taking a pool of location data collected by its partners and comparing that to its database of fast food restaurant coordinates.
Advertisers could then use that data to show those users ads for fast food chains, or perhaps healthier alternatives or gym memberships—all without those people ever having to install a Foursquare app.

[1](https://www.wired.com/2016/01/foursquares-plan-to-use-your-d...)

syncopate• 8 years ago

Isn't that called geofencing? It's been around for years. I always felt that the main reason e.g. Facebook wants you to use their app is to be able to supply data for conversions of geofencing ad campaigns, e.g. someone saw an ad for a promotion at some burger place and then actually came to close proximity of their wlan.

crystaln2• 8 years ago

And Facebook or Google? They certainly track your location without a user centric business case. I don't think ad presentation qualifies.

RandallBrown• 8 years ago

While Swarm has an auto-check in feature where it tracks your location, location services isn't really required to use the app.

Since the user is actively telling Foursquare/Swarm where they are, I don't think Apple would mind.

Rjevski3• 8 years ago

Finally.

I wish third-party analytics would be next. A lot of apps are using analytics from companies who’s business model is inherently incompatible with privacy (Facebook & Google) and that concerns me.

MBCook2• 8 years ago

The speculation is this is GDPR motivates, hopefully it will cause a crackdown on that stuff too.

The fact Apple added a framework to help with analytics (IIRC) may be the first step towards REQUIRING people to only use that framework instead of 3rd party stuff so they can be sure it’s compliant with laws/Apple’s policies as well.

Fradow2• 8 years ago

GDPR doesn't regulate anonymous data. Unless you put PII in your analytics (not the default, and you really shouldn't) you won't have a problem.

As a matter of fact, I'm pretty sure part of Google Analytics response to GDPR is "Don't put PII in there if you want to be GDPR compliant" (they are providing tools for compliance though).

mkirklions• 8 years ago

Facebook is a bit much, they are a gigantic company that can spend the time and look into your analytics and years of posting data.

However, an app that collects data at best is getting your location and stereotype.

acdha• 8 years ago

Location seems like an awful lot: think about what analysis would show about the places you visit and who is there at the same time. Sure, going to the supermarket probably isn’t that interesting but what about a political rally, gay bar, family planning clinic, law firm which specializes in divorce or labor lawsuits, etc.?

UncleMeat• 8 years ago

Should all developers be required to write analytics themselves?

princekolt3• 8 years ago

Apple could require the analytics reporting to be opt-in.

s73v3r_• 8 years ago

There are a few analytics solutions that are self-hosted.

tzahola• 8 years ago

Not my problem.

samfriedman• 8 years ago

If third-party analytics is nixed, the same companies will just switch to a consulting model that lets them set up analytics for app authors in-house, making it first-party.

julianozen• 8 years ago

Hey, are there any other developers experiencing this besides the one in the article?

We noticed a few weeks ago that Apple has changed their static analysis tool and has been more aggressive with rejections. Has anyone else actually seen their app retroactively pulled from the App Store?

_31• 8 years ago

I haven't had the exact issue discussed in the article, but I have noticed that they have been really aggressive with rejections lately. Just this last week an app I'm trying to get into the store has been rejected 4 times, with the same exact automated message. I respond with an assertion of my apps compliance, but get the same automated response. These are the first rejections I've received in 7 years of submitting apps.

scarlac• 8 years ago

Do you have an idea what rules you could be violating? Even with a good history, there's no guarantee an update is still good so they have to stay vigilant. Chrome store is a good example of this where popular extensions are sometimes bought and an update is pushed out with malware or spyware.

SEJeff6• 8 years ago

If you're worried about analytics and tracking / ads on your iPhone, consider installing Disconnect's Privacy Pro:

https://lifehacker.com/disconnect-pro-eliminates-tracking-on...

It costs a few $$, but sets up a VPN profile that is generally always on. It just blocks all of the ads / "web bugs" / analytics stuff and gives you a UI to show how much. Apple cracking down is a good thing, but so is defense in depth. It estimates that it has blocked 8Mb of crap being downloaded on my phone just today.

pdimitar• 8 years ago

I've been pretty happy with 1Blocker Legacy but I never actually confirmed it really blocks trackers (creators claim it does).

Thanks for the link, I'll consider buying.

princekolt3• 8 years ago

While the concept is good, I'd be extremely concerned of using any third party VPN service, free or paid. You are basically trusting your entire internet usage to a single entity, and I think this is way too risky.

One alternative is setting up a raspberry-pi at home running pi-hole and OpenVPN. While it is still not risk-free, it is still better than one centralized entity taking everyone's traffic. On the other hand, setting that up is still not absolutely straightforward, but it is getting better.

MBCook2• 8 years ago

I agree.

“Don’t like being tracked? Just let us watch EVERYTHING you do and we promise to stop people from tracking you.”

You’re putting someone in the perfect position to track you far better than anyone else could. You better REALLY trust them.

SEJeff6• 8 years ago

It is not actually a vpn. It is a glorified /etc/hosts 127.0.0.1 null route app. It doesn't send any traffic over any real VPN, so your worry isn't a thing.

stirner2• 8 years ago

Disconnect was co-founded by an ex-Google DoubleClick (ad) engineer, and hired an ex-NSA (dragnet surveillance) engineer. There are tracker-blocking adblockers for every platform that aren't made by people with anti-privacy backgrounds.

SEJeff6• 8 years ago

And SELinux was designed by the NSA due to the 10 years or so of the Flask Security Architecture and made it into Linux. Under your tinfoil hat, does this mean that Linux is totally compromised?

sbhn2• 8 years ago

What, is it legitimate companies selling your data? The fear media told me it was hackers.

Johnny555• 8 years ago

You must have your head in the sand if you don't see the "fear media" also warning you about legit companies tracking you.

https://www.nytimes.com/2018/04/11/technology/facebook-priva...

https://www.bloomberg.com/news/articles/2018-05-07/even-priv...

https://www.wsj.com/articles/who-has-more-of-your-personal-d...

https://www.forbes.com/sites/kalevleetaru/2018/05/03/what-th...

sbhn2• 8 years ago

None of those articles made pole position. Only articles with ‘Hackers’ in the subject line, that’s plural, make pole position when amplifying that people’s personal data is under attack.

jacksmith210062• 8 years ago

Just hope they let the user chose.

gruez4• 8 years ago

and what do you do when users get strongarmed (app refusing to run, dark patterns, etc.) into "accepting"?

jacksmith210062• 8 years ago

Well then define how you make it clear to the user.

I worry a bit that we will go too far with things. Some want the benefits of having the data to make user experience better.

I am a perfect example of this.

shimfish• 8 years ago

I'm curious as to how this behaviour is actually detected. I mean are they checking for outgoing network requests that contain something that looks like co-ordinates because presumably that would be trivial to obfuscate.

Or is this really just a case of rejecting apps that are asking for location even though the app has no real use for it?

LeoNatan25• 8 years ago

Apps are required to have an entry in the Info plist for location (both “while in use” and “always”). This is enforced by the kernel. So they are most likely looking there.

grantlmiller• 8 years ago

Isn't it just as likely that this data is being sent to the app vendor's servers and then off to one or multiple third-parties?

crystaln2• 8 years ago

It's interesting how everyone hates the App Store approval model until they demand it be implemented more strictly.

longtermsec• 8 years ago

Apps are one risk, but it's an opt-in risk.

Telecom companies are also another risk, and much larger one in that, because there is no opt out of location sharing with them. Same with analytics on your telco network traffic.

kvm000• 8 years ago

Would be nice if there was a more granular option for access to photos which allowed "image only" with no metadata... I assume most people don't realize when they grant photo library access to a cheap filter app that the app can grab the datetime and GPS location for all photos as well, which is a lot of data if they have a phone full with a ton of photos.

MessageLife1122• 8 years ago

I am glad on reading even just looking at the headline. haha

Apple cracking down on applications that send location data to third-parties

Related Stories