Your iPhone protects your privacy — from everyone except Apple, apparently.
France’s data protection authority, CNIL, fined Apple €8 million (about $AU2 million) Wednesday for illegally harvesting iPhone owners’ data for targeted ads without proper consent.
It’s an unusual sanction for the iPhone maker, which has faced fewer legal penalties over privacy than its Big Tech competitors. Apple makes privacy a selling point for its devices, plastering “Privacy. That’s iPhone.” across 12.19 m billboards across the world. The French fine, though, is the latest addition to a growing body of evidence that Apple may not be the privacy guardian angel it makes itself out to be.
Apple failed to “obtain the consent of French iPhone users (iOS 14.6 version) before depositing and/or writing identifiers used for advertising purposes on their terminals,” the CNIL said in a statement. The CNIL’s fine calls out the search ads in Apple’s App Store, specifically. A French court fined the company over $1 million in December over its commercial practices related to the App Store.
“We are disappointed with this decision given the CNIL has previously recognised that how we serve search ads in the App Store prioritises user privacy, and we will appeal,” said an Apple spokesperson. “Apple Search Ads goes further than any other digital advertising platform we are aware of by providing users with a clear choice as to whether or not they would like personalised ads.”
You may not think of Apple as an advertising company, but that may change in the near future. Apple does a tidy advertising business which will net an estimated $7 billion this year, according to analytics firm Insider Intelligence. Apple shows ads on a number of its services, including the App Store, and reports suggest the company is in talks to bring ads Apple TV. That ad business is expected to grow tremendously in the near future. After crippling the Facebook advertising network with a powerful iPhone privacy setting in 2021, Apple is in the perfect position to expand its burgeoning ad empire.
Many of Apple’s ads are targeted, just like the ones delivered by competitors the company is fond of criticising. Apple shows you those targeted ads and collects the relevant data with your permission, though. But that’s where Apple ran into trouble with the French.
With iPhones running iOS 14.6 and below, Apple’s Personalised Advertising privacy setting was turned on by default, leaving users to seek out the control on their own if they wanted to protect their information. That violates EU privacy law, according to the CNIL. It doesn’t cross the Europe’s GDPR, though; the violation falls under the more obscure ePrivacy Directive of 2002.
The newer versions of the iPhone operating system corrected the problem, presenting users with a prompt before the advertising data was collected.
“Apple has finally been caught red handed: the same companies that have been telling us how their products and services are forerunners in terms of data protection are blithely violating the applicable law,” said Nicolas Rieul, president of Alliance Digitale, a French digital marketing trade group, in a statement. “This is a real problem misleading and deceptive advertising on a larger scale, which we invite the French authorities to address.”
As Apple ramps up its advertising business, the company is facing more scrutiny for its less-than-perfect privacy practices. A recent investigation found that Apple collects analytics data even when the company’s own analytics privacy setting is turned off. Apple faces a class action lawsuit over the matter, and Alliance Digitale’s Rieul told Gizmodo his organisation is pressuring the CNIL to pursue regulatory action as well.
Eight million euros is peanuts for a company that makes billions a year on advertising alone and is so inconceivably wealthy that it had enough money to lose $1 trillion in market value last year — making Apple the second company in history to do so. The fine could have been higher but for the fact that Apple’s European headquarters are in Ireland, not France, giving the CNIL a smaller target to go after.
Still, its a signal that Apple may face a less friendly regulatory future in Europe. Commercial authorities are investigating Apple for anti-competitive business practices, and are even forcing the company to abandon its proprietary charging cable in favour of USB-C ports.