Apple is facing a proposed U.S. federal class action lawsuit accusing it of recording users' mobile activities without user consent and privacy guarantees, which violates the California Invasion of Privacy Act. In a lawsuit filed by New York-based iPhone 13 user Elliot Libman, Apple is accused of completely falsely guaranteeing users control over the information they share when using its iPhone Stock app.
The class action alleges that Apple's mobile device options to disable device analytics sharing and opt out of settings such as "Allow apps to request tracking" do not prevent Apple from continuing to collect data related to users' browsing and activities for monetization purposes.
Apple records, tracks, collects, and monetizes analytics data (including browsing history and activity information) regardless of the safeguards or "privacy settings" consumers have in place to protect their privacy. Apple continues to record consumers' app usage, app browsing communications, and personal information even if consumers follow Apple's instructions and turn off "Allow apps to request tracking" and/or "Share [device] analytics" in their privacy controls Among its proprietary Apple apps are the App Store, Apple Music, Apple TV, Books, and Stocks.
In support of its allegations, the complaint cites a recent Gizmodo report covering claims by security researchers at software company Mysk. Earlier this month, researchers Tommy Mysk and Talal Haj Bakry claimed to have found evidence that analytics controls and anti-tracking settings had no appreciable impact on Apple's data collection in the aforementioned apps.
For example, according to the researchers, App Store apps are constantly collecting vast amounts of usage data in real time, including what users click on, what apps they search for, what ads they view, and how long users view any given app. In addition to these details, Apple is said to be able to collect typical details of a device's fingerprinting method, including ID number, device model, screen resolution, installed keyboard language, and type of internet connection.
In another example, the Mysk researchers said the Stocks app sent Apple a user's list of followed stocks, stocks viewed or searched for (including timestamps), and a record of news articles viewed in the app. The information is said to be sent to a URL via a separate transport from the iCloud communication required to sync user data across devices.
The researchers discovered the traces using a jailbroken iPhone running iOS 14.6. It's worth noting that while the team found similar iPhone activity on non-jailbroken phones running iOS 16, the data was encrypted, so it wasn't possible to determine exactly what it contained. However, that limitation hasn't stopped the findings from sparking lawsuits.
Through its pervasive and illegal data tracking and collection practices, Apple knows even the most private and potentially embarrassing aspects of users' use of apps whether or not users accept Apple's bogus offer to choose to keep such activities private, the lawsuit says.