In November, Gizmodo exclusively reported that Apple harvests data about its users even after they flip the switch on an iPhone privacy setting that promises to “disable the sharing of device analytics altogether.” Since then, consumers across the country have filed at least 12 different class-action lawsuits about the problem. Apple ignored dozens of questions from Gizmodo and other reporters, until now. In an article in The Hollywood Reporter, Apple finally broke its silence — with a statement that seems to include glaring contradictions.
“Identifiable information is never shared with third parties and is not used to track users across apps and websites,” Apple said, according to The Hollywood Reporter. “All data used for advertising purposes is disassociated from personal identifiers, and Apple Advertising operates on the basis of de-identified data.” Apple did not respond to yet another request for comment from Gizmodo.
Tests conducted by researchers at Mysk, an app development company, suggest that almost every fact in that statement is inaccurate.
“Apple’s statement is too short and generic to clearly and accurately address our findings,” said Tommy Mysk, one of the researchers who uncovered the problem.
Open up your iPhone’s settings, tap “Privacy & Security,” and scroll down to “Analytics & Improvements.” There you’ll find a setting label “Share iPhone Analytics.” Toggle it on and off all you want. Tests from Mysk found that Apple collects device analytics data, no matter how you adjust the control.
Mysk’s tests showed Apple harvesting information in real time about almost everything you do on certain Apple apps, including what you click on, search for, and which ads you see. That data is sent along with a unique ID number called the Device Services Identifier, or DSID, which is directly tied to your iCloud account, linked to you name, phone number, and email in Apple’s systems, according to Mysk.
“As long as the data contains the DSID, it should be considered identifiable, as it is linked to the user’s identity,” Mysk said.
Apple’s privacy spokesperson Shane Bauer gave the same statement to Wired for an article in mid-January about all of the different ways the company tracks it users. But in the Hollywood Reporter, Apple’s comments appear in direct relation to the privacy problems reported by Gizmodo.
Apple’s statement also mirrors apparent inaccuracies in its privacy policies, where the company writes that “none of the collected information identifies you personally.”
What’s more, Apple tracks users using similar data across numerous apps, along with the DSID in many cases, including the App Store, Apple Music, Apple TV, Books, and Stocks, the tests say. “This means that Apple can track users across its apps,” Mysk said, even if Apple isn’t using the data track users across apps made by other companies or developers.
The tests show that analytics data and advertising data are sent to the same server, xp.apple.com. It’s possible that behind the scenes, that data is processed to remove the DSID, and there could be a firewall between the analytics data Apple collects and the databases that link your DSID to your name and contact information. We don’t know because Apple hasn’t said anything about it. Unique identifiers can be better at identifying you than your actual name, that’s part of the reason tech companies use them in the first place.
Gizmodo asked Apple to explain the discrepancies between its comments to the Hollywood Reporter and Mysk’s test results. The company did not immediately respond. This marks the eighth time Gizmodo asked Apple to explain its analytics privacy problems. So far, we haven’t heard anything back.
The comments raise more questions than they answer, and they ignore the biggest problem surrounding Apple’s analytics data collection, the issue at the heart of the 12 different lawsuits the company is dealing with.