Apple has been named in a class action lawsuit alleging that iPhones and iPads produce devices, such as a Unique Device Identifier (UDID), which allows advertisers to track what applications users download, how frequently they use them and for how long.
The suit also claims that some Apps are selling the personal information that they receive from customers to advertisers. This includes sensitive information such as the user’s location, age, gender, income, ethnicity, sexual orientation and political affiliations.
This suit comes on the heels of a recent Wall Street Journal investigation that showed how smartphone Apps are sharing personal data. The WSJ examined 101 popular smartphone Apps and found that 56 of them transmitted the phones UDID to other companies without the users’ awareness or consent . Forty-seven Apps transmitted the phone’s location in some way and five Apps sent age, gender and other personal details to outsiders .
The fact that the UDID number is the most shared piece of information is the most discerning fact. A UDID is a number unique to each person’s phone that can be used to track all of the user’s activity without giving them the option to shut it off. Think of it as the “cookie” on your computer web browsers. On computers these can usually be turned off or at least limited in some way so that your data is not released to random companies.
Because the UDID is specific to a person’s phone, and can’t be changed or blocked by the user, the complaint alleges that the release of this information to an outside company includes violations of the US Computer Fraud and Abuse Act and Electronic Communications Privacy Act, plus California’s Unfair Competition Law and Consumer Legal Remedies Act .
Two of the Apps sharing the most information include TextPlus 4, a popular iPhone App for text messaging, and Pandora, a popular music App. TextPlus sent the UDID number to eight ad companies and the phone’s zip code, along with the user’s age and gender, to two of them. Pandora sent its user’s location data to seven of ad trackers, their UDID to three trackers and demographic data to two. As such, Pandora has been named a co-defendant in this suit.
According to the study, Apple says that iPhone Apps “cannot transmit data about a user without obtaining the user’s prior permission and providing the user with access to information about how and where the data will be used.” However, many of the Apps tested by WSJ appeared to violate that rule, by sending a user’s location to ad networks, without informing users. The study found that 45 of the 101 Apps tested didn’t provide privacy policies on their websites or inside the Apps at the time of testing.
The suit was filed by Jonathon Lalo in the US District Court of the Northern District of California. In addition to Apple and Pandora the suit names Dictionary.com, Backflip, and The Weather Channel as co-defendants. Lalo’s lawyers are seeking class-action status for any Apple customers who downloaded an application on their iPhone or iPad between December 1, 2008 and December 20, 2010 .
To read the complaint, click here.