Apple App Store tracks users without consent using sensitive personal data
Poor Privacy Practices Of The Apple App Store: Cookies, Advertising and Tracking Of Users
Networking and Internet Architecture
Summary
The Apple App Store collects and stores lots of information about users without asking permission. It uses cookies and tracking IDs to follow what apps and ads users look at or click on. The researchers found that Apple even uses very private details like religion, health, and sexuality to choose which ads to show. Much of this data collection is not necessary for the app store to work properly. There is no way for users to stop this tracking or opt out.
What this means in practice
- •For privacy compliance officers: Evaluate and improve app store data handling policies to meet GDPR and user consent requirements.
- •For mobile device security teams: Monitor and mitigate unauthorized user tracking and data leakage in app store communications on smartphones.
Authors
Douglas Leith
Abstract
We analyse the data that the Apple App Store sends to and receives from Apple servers. We find that multiple cookies are sent by Apple servers and stored on the handset. Adverts with tracking identifiers are also stored on the handset, and we observe that adverts are selected by Apple servers using GDPR special category personal data such as sexuality, religious beliefs and health. User interactions with the Apple App Store (apps and adverts viewed, buttons clicked, searches made etc) are transmitted to Apple servers alongside identifiers linking this data to the individual user and device. We show that much of this data storage and transmission is not essential for the service requested by the user, namely to view, search and install apps. No consent is sought for any of this data storage and processing, and there is no opt out.