Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

2/1/2011
02:11 PM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Apple Sued Over iPhone Data Privacy

The disclosure of Unique Device Identifiers associated with Apple's mobile devices represents a privacy law violation, the complaint claims.

Apple last week was sued in San Jose, Calif., for alleged privacy and state business law violations arising from its disclosure of iPhone device identifiers and personal information.

Plaintiff Anthony Chiu, a resident of Alameda, Calif., claims that Apple knowingly transmits data to third parties that can be used to identify users of Apple's mobile devices, without user consent and in violation of various laws. The legal filing also targets 50 unnamed "John Doe" defendants, raising the possibility that third-party developers of apps that use the data in question could wind up in court.

The case hinges on Apple's use Unique Device Identifiers (UDIDs), serial numbers associated with every mobile device. The complaint states that Apple allows UDIDs to be displayed to application developers and allows downloaded apps to access the user's browsing history whenever the user clicks on an ad or application using his or her mobile device.

"Consequently, anyone who has used a mobile device to browse the Internet to obtain advice about hemorrhoids, sexually transmitted disease, abortion, drug rehabilitation, or care for the elderly; to search for jobs, seek out new romantic partners, engage in political activity; in fact, to do more or less anything; can be reasonably sure that the browsing history created by such investigation has been incorporated into a detailed dossier for sale to marketers," the complaint says.

The complaint goes on to cite a Wall Street Journal investigation that found 56 out of 101 iOS and Android apps tested transmitted UDID numbers without authorization or consent. It also cites an academic paper published last year that found 68% of apps tested transmitted UDIDs.

The UDID is effectively a "super-cookie," the complaint alleges, and Apple fails to inform users about it in its privacy policy. In fact, the complaint states, Apple specifically disavows the sharing of personal information with third-parties for marketing purposes. As such the company's privacy policy would be more accurately described as a disclosure policy, the complaint suggests.

The key issue here is whether UDID numbers are actually deemed to be personal information. It's not entirely clear that they are. Eric Goldman, associate professor of law at Santa Clara University School of Law, said in an e-mail that there has been a flood of lawsuits in recent months over the disclosure of unique identifiers. He pointed to Facebook, which is being sued over its disclosure of Facebook's user ID numbers in its URLs. (In response to privacy concerns, Facebook has proposed encrypting user ID numbers.)

Goldman says that before the merits of the case can be evaluated, a number of questions have to be answered. "Does disclosing a unique ID actually disclose anything 'private' or otherwise legally protected?" he asked in an e-mail. "Did the users expressly or impliedly consent to the disclosures? Perhaps most importantly, did the users suffer any legally cognizable harm? Courts have been suspicious of privacy lawsuits where the consumer's only 'harm' is that the company made a contrary promise."

According to Andre Rado, a partner at Milberg LLP, the firm representing the plaintiff, UDID numbers do represent protected personal information.

"Privacy is 'protected' under the California constitution," Rado wrote in an e-mailed statement. "Transmission of the UDID would allow the recipient to identify exactly what a user is browsing and, together with other information, where they are at any given time. In addition, there are are disclosure-based and contract-based claims in the action."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31476
PUBLISHED: 2021-06-16
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.3.37598. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the han...
CVE-2021-31477
PUBLISHED: 2021-06-16
This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware and filesystem of the device. The firmware and filesystem contain hard-...
CVE-2021-32690
PUBLISHED: 2021-06-16
Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. This...
CVE-2021-32691
PUBLISHED: 2021-06-16
Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by only knowing their basic profile information (name, birthday, gender, etc). This includes all app functionality within th...
CVE-2021-32243
PUBLISHED: 2021-06-16
FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).