Following a report on Apple’s App Store data collection, a lawsuit alleges that the company intentionally violated user privacy and monetized user data without permission. The plaintiff, Elliot Libman, has filed the class action lawsuit he initiated against Apple. The lawsuit alleges that because Apple has knowledge of what users view on the App Store, it has violated the privacy rights that users have.
The lawsuit alleges that research published in November exposed that Apple “records, tracks, collects and monetizes analytics data – including browsing history and activity information – regardless of the safeguards or “privacy settings” consumers have put in place to protect their privacy.” The lawsuit cites the “allow apps to request tracking” and “share analytics” settings as their main issues with Apple.
“Apple’s practices violate consumers’ privacy; intentionally deceive consumers; entitle Apple and its employees to intimate details about individuals’ lives, interests and app usage; and make Apple a potential ‘one-stop shopping’ target for any government, private or criminal actor who wants to undermine individuals’ privacy, security or freedom. Through its pervasive and illegal data tracking and collection operations, Apple knows even the most intimate and potentially embarrassing aspects of a user’s app usage – regardless of whether the user accepts Apple’s illusory offer to keep those activities private.”
Attorneys for the plaintiffs argue that the complainants have a tough hill to climb to win this lawsuit. It’s unclear whether the plaintiffs or the attorneys filing the lawsuit understand the difference between server-side data collection and how the setup at the heart of the lawsuit works.
It is also likely that the data cited in the lawsuit was collected on the server side. For example, video streaming Netflix viewing history is stored server-side and tied to an account and collected on the server, where the “do not track” request setting does not apply.
In the case of server-side data, the “Allow applications to request tracking” and “Share analytics” settings are irrelevant. The section on “Share Analytics” itself may also be irrelevant because the browsing history of an application is a user action, not related to device analytics, which is used to determine the status of a device and its Internet service in the event of a problem.
And there is prior precedent that the “app developer” and the company hosting the app store, in this case Apple, are not one and the same, even though the app store is an app.
Mysk’s research, which inspired the lawsuit, said that under iOS 14.6, “detailed usage data” for the App Store, Apple Music, Apple TV and Books was sent to Apple. The researchers say the stock sends less identifiable information than other apps. The data sent was reportedly associated with an identifier that could identify the user. This behavior is reportedly still present in iOS 16, but the researchers were unable to check what data was sent because it was sent encrypted.
The researchers did tell Gizmodo that Health and Wallet did not send similar data under any combination of privacy settings. All data was sent to a different server than iCloud’s array.
The lawsuit claims that consumers’ personal information has a cash value. The research cited in the lawsuit is based on the sale of data, some of which was collected through hacking and data theft. Apple says it is not selling user data, and there is no evidence that it is.
Apple has also made clear how it uses data on its advertising platform. The company has publicly stated that its advertising platform does not connect user or device data to data collected from third parties for targeted advertising. They also say they do not share user device or device identification with data collection companies.
The lawsuit claims that Apple “violated areas of privacy protected by the Fourth Amendment” and “violated dozens of state criminal laws on wiretapping and invasion of privacy,” and that the Fourth Amendment does not appear to apply here.
It’s not clear why the company you’re doing business with agreed to collect data in the product’s terms of service, in which case both the App Store, and the iPhone itself, violate anti-eavesdropping laws, especially if Apple anonymizes or aggregates any data collected by the App Store.
It goes on to cite “highly offensive” behavior as it relates to “intentional intrusion” into Internet communications and “covert monitoring of private app browsing. For Apple or any app store to make data about app store browsing and purchases available to customers on the Internet requires, to some extent, that the company know what any particular user is browsing and what they are buying.
Much of this depends on which technology or Internet company the user trusts. For example, Apple’s technology already prevents filers’ ISPs or wireless carriers from knowing what they are browsing.
Identifiable user data is needed not only to run the Internet industry, but also to authenticate and operate paid services such as the App Store, books and music, and to provide support for said services. Clearly, based on the “highly offensive” overtones of Apple’s behavior in the filing, the prosecution does not trust Apple in this regard.
As always, the suit seeks “damages and all other forms of equitable monetary relief,” as well as such injunctive relief as the court may deem appropriate. A jury trial has been requested.
It is unclear when or if the case will be heard.
Lieberman v. Apple, Inc. is pending in the U.S. District Court for the Northern District of California, Case No. 5:2022cv07069.
