EPIC - Location Privacy: Apple iPhone / iPad

Location Privacy: Apple iPhone / iPad

On April 20, 2011, Alasdair Allan and Pete Warden announced that they had discovered that the Apple iPhone and the Apple 3G iPad were regularly recording the devices' locations into a hidden file. The data gathering, they claimed, was "clearly intentional."

Top News |
Background |
Additional Resources |
Latest News

Top News

EPIC Ask FTC to Investigate Privacy Risks of Pokemon GO: EPIC has urged the FTC to launch an investigation of Pokemon GO and the app's developer Niantic. When the augmented-reality app was first released, Niantic granted itself "full access" to users' Google accounts in violation of federal privacy law. Even after recent changes, the company continues to collect detailed location history and has access to smartphone cameras. Pokemon GO "raises complex and novel privacy issues that require close FTC scrutiny," EPIC told the Commission. Senator Al Franken recently sent a letter to the company asking for clarification on the scope and purpose of its data collection. Niantic has close ties to Google and its CEO oversaw Google's controversial Street View project, which was found to collect private wifi data transmissions. (Jul. 22, 2016)
Federal Court Lifts Gag Order on National Security Letter Recipient: For the first time, a federal court has lifted a national security letter gag order, allowing an Internet Service Provider to publish the FBI's demands for records of user web browsing history, IP addresses, online purchases, and location information. The FBI issues thousands of NSLs each year, forcing companies to disclose troves of consumer records without probable cause. Recipients are preventing from acknowledging these warrantless searches. EPIC filed an amicus brief in In re National Security Letter, arguing that NSL gag orders frustrate the public's right to know about government surveillance programs. (Dec. 1, 2015)
U.S. Supreme Court Tosses Out North Carolina Lifetime GPS Tracking: Today the U.S. Supreme Court issued a per curium opinion vacating the decision of the North Carolina Supreme Court in Grady v. North Carolina. Grady challenged a court order requiring a "satellite-based [GPS] monitoring program for the duration of his natural life." The North Carolina court ruled that this was not a Fourth Amendment search. However, the U.S. Supreme Court tossed that ruling aside, finding it contrary to recent decisions in United States v. Jones and Florida v. Jardines. EPIC filed an amicus brief in Jones, joined by many leading technical experts and legal scholars. The Court held in that case that continuous GPS tracking constituted a search. (Mar. 30, 2015)
Facebook Modifies User Privacy Policy: Facebook has modified its privacy and data use policies, effective January 1, 2015. Facebook will now allow advertisers to include a “buy” button directly on targeted advertisements on a user’s page. Facebook will also allow advertisers to use the location data gathered from tools like “Nearby Friends” and location "check-ins” to push geolocation-based targeted advertisements. For instance, a Facebook user who checks in near a restaurant that partners with Facebook may now be shown menu items from that restaurant. Last month, the Dutch data protection commission announced that it planned to open an investigation into Facebook’s policy modifications. In July 2014, EPIC and a coalition of consumer privacy groups urged the FTC to halt Facebook’s plan to collect web-browsing information from its users. Facebook is already under a 20 year consent decree from the FTC that requires Facebook to protect user privacy. The consent decree resulted from complaints brought by EPIC and a coalition of consumer privacy organizations in 2009 and 2010. For more information, see EPIC: Facebook Privacy; and EPIC: FTC. (Jan. 2, 2015)
EPIC Backs Comments on Location Privacy: EPIC has joined a coalition of consumer privacy groups in comments to the Federal Communications Commission on the "Roadmap for Improving E911 Location Accuracy." EPIC and the groups explained that collecting location information without privacy protections puts customers at risk. EPIC filed similar comments with the FCC in 2007. EPIC urged the Commission to recognize that "(1) the FCC has an obligation to protect the privacy of consumer information generated by the provision of communication services; (2) current regulations do not adequately location-based information, (3) legal frameworks, notably in the European Union, provide safeguards for location data, and (4) the Commission should establish rules that limit the use of customer location-based information." EPIC has frequently advocated for express authorization prior to disclosure of "call location information." The "Roadmap" raises concerns that the location of telephone users will be routinely known to federal agencies, whether or not there is an emergency. EPIC has also filed amicus curiae briefs in the U.S. Supreme Court and the Supreme Court of New Jersey arguing that location tracking by the government is a search under the Fourth Amendment and should only be conducted with a judicial warrant. For more information, see EPIC: Locational Privacy. (Dec. 16, 2014)
Senator Markey Asks Justice Department About Cell Phone Tracking Program: Senator Edward J. Markey (D-MA) has sent detailed questions to Attorney General Holder about recent reports that law enforcement agencies have deployed aircraft equipped with cell tower simulators to capture mobile phone communication. The devices, known as "IMSI catchers" or "Stingray," identify and track cell phone users. Senator Markey wrote "the sweeping nature of this program and likely collection of sensitive records...raise important questions about how the Department protects the privacy of Americans" with no connection to unlawful activities. EPIC successfully sued the FBI to obtain documents about the agency's use of Stingray devices. EPIC has also filed amicus curiae briefs in the U.S. Supreme Court and the Supreme Court of New Jersey arguing that location tracking is a search under the Fourth Amendment and should only be conducted with a judicial warrant. For more information, see EPIC: Locational Privacy and EPIC v. FBI (Stingray). (Nov. 17, 2014)
Apple Announces New Privacy Enhancing Techniques: The most recent product announcement from Apple, includes several privacy enhancing techniques that EPIC has favored, including randomized MAC addresses, end-to-end encryption, robust screen lock, and implementation of secure electronic payment systems. Still, EPIC has raised questions about Health Kit, which enables the collection and transfer of sensitive medical information, and the enforcement of developer guidelines. For more information, see, EPIC: Practical Privacy Tools and EPIC: Location Privacy. (Sep. 23, 2014)
Apple Announces New Privacy-Enhancing Techniques in iOS 8: Apple has announced new privacy-enhancing techniques that will limit the ability of third parties to track Apple mobile devicesi. Specifically, iOS8 will use "random, locally administered MAC addresses," instead of unique device IDs, to connect to the Internet. Mobile phones can now be tracked by law enforcement and private companies because of the unique MAC address associated with the device. In 2004 when the adoption of IPv6 raised privacy concerns, EPIC recommended that MAC addresses be randomized to avoid tracking. The change in the Apple iOS implements this proposal. For more information, see EPIC: Practical Privacy Tools and EPIC: Location Privacy. (Jun. 10, 2014)
Senate Holds Hearing on Consumer Location Privacy Protection: The Senate recently held a hearing on the Location Privacy Protection Act of 2014 authored by Senator Franken. In an opening statement, Senator Franken said his "bill makes sure that if a company wants to get your location...they need to get your permission first." FTC Director, Jessica Rich, testified that location data is "sensitive information" that "raises privacy concerns." The FTC recently signed a 20-year consent order with Snapchat after finding the app was collecting location information in contradiction to its stated privacy policy. The FTC investigated Snapchat after EPIC filed a complaint with the agency detailing the companies deceptive practices. EPIC also filed an amicus brief in a location privacy case in which the New Jersey Supreme Court case announced a landmark decision, holding that individuals have an expectation of privacy in their cell phone data.For more information, see EPIC: Location Privacy. (Jun. 6, 2014)
Massachusetts Court Upholds Privacy Protection for Location Records: In Commonwealth v. Augustine, the Massachusetts Supreme Judicial Court ruled that an individual has a reasonable expectation of privacy in cell phone location records held by a company. Article 14 of the Massachusetts Constitution, similar to the Fourth Amendment, provides that individuals should be free from "unreasonable searches, and seizures." The court held that obtaining two weeks of phone location records was a search, requiring a warrant. EPIC filed "friend of the court" briefs in Commonwealth v. Connolly, a similar case in Massachusetts concerning warrantless GPS tracking, and State v. Earls, a case in which the New Jersey Supreme Court held that location data is protected under the state constitution. EPIC also filed a brief in In re U.S. Application for Historical Cell Site Data, where an appeals court held that users have no reasonable expectation of privacy in location records under the Fourth Amendment. The Massachusetts Supreme Court considered all three cases. For more information, see EPIC: Location Privacy. (Feb. 20, 2014)

Background

On April 20, 2011, two data scientists, Alasdair Allan and Pete Warden, conducted a discussion at Where 2.0, an annual conference on location-aware technology and business. Allan and Warden announced that they had discovered that the Apple iPhone and the Apple 3G iPad were regularly recording the devices' locations into a hidden file, explaining how they made the discovery, what they thought the collection implied, and how users would be able to view their own data.

Following the announcement, several journalists and researchers delved further into an issue, and much speculation occurred about if the data was being transmitted to Apple and if the tracking was exclusive to the iPhone / iPad, or if it also was occurring on other smartphones, including android-based hardware.

Apple has made many statements in support of locational privacy in the past. With the release of OS4, on April 8, 2010, Scott Forstall, the Senior Vice President for iPhone Software, stated: "For all these location things, we take privacy very, very seriously. Ever since we added the first API's for location, we would put up a panel whenever an application wanted to use your location - and the user would have to approve this. We're taking privacy several steps further - in iPhone OS 4." In clarification, Forstall explained exactly what steps would be taken to protect location privacy:

"First, we're adding an indicator right on the status bar to let you know if any application is asking for your location. Be it a foreground application or one of the background applications - so you could know if something is tracking your location."
"Next - we're adding fine grain settings - so you could see all of the application that would like to use your location and the user can enable or disable location, per application."
"And on top of all of this, if any application has asked for your location in the last 24 hours, we'll add an indicator right next to that app - so you could know that it's asked for your location."
"So we're being completely transparent on the usage of location and we're letting user set, on an app-by-app basis, the ability for apps to use location."

In April 2010, Apple changed its Privacy Policies regarding locational data. At the time, Representative Edward Markey (D-Mass) and Representative Joe Barton (R-TX), sent a letter to Apple's Steve Jobs asking for an explanation for the change in policy and how the changes would effect compliance with the Telecommunications Act (47 U.S.C. § 222). In a lengthy response, Apple explained that the change was meant to address Apple's location-based services. Apple assured that customer's location-based GPS information that Apple collected from mobile devices would be "stored in a database accessible only by Apple."

Apple's Privacy Policy, as of the date of the discovery, included two explicit statements about location data:

"[Apple] may collect information such as occupation, language, zip code, area code, unique device identifier, location, and the time zone where an Apple product is used so that we can better understand customer behavior and improve our products, services, and advertising."
"To provide location-based services on Apple products, Apple and our partners and licensees may collect, use, and share precise location data, including the real-time geographic location of your Apple computer or device. This location data is collected anonymously in a form that does not personally identify you and is used by Apple and our partners and licensees to provide and improve location-based products and services. For example, we may share geographic location with application providers when you opt in to their location services."

Apple also carries a TRUSTe Privacy Seal:

Apple Inc. has been awarded TRUSTe’s Privacy Seal signifying that this Privacy Policy and practices have been reviewed by TRUSTe for compliance with TRUSTe’s program requirements including transparency, accountability, and choice regarding the collection and use of your personal information.

On April 21, 2011, Representative Edward J. Markey (D-Mass), sent a letter to Steve Jobs, the CEO of Apple, Inc. Rep. Markey voiced concern for the "consequences of this feature for individuals' privacy," and proposed the following questions:

Is it accurate that Apple iPhone keeps track of where iPhone users go, saving this information to a file on the device that is then copied to the owner's computer when the two are synchronized?
Did Apple intentionally develop this functionality in order to log the locations of users?
How does Apple collect this customer location information? 
Does Apple use this information for any purpose?
Has Apple used this location information for any commercial purpose? 
Is it possible for customers to disable this feature?  
Given the widespread usage of iPhones and iPads by individuals under the age of 18, is Apple concerned that the wide array of precise location data logged by these devices can be used to track minors, exposing them to potential harm?

In a similar letter, sent on April 21, 2011, from Senator Franken (D-Minn), the following questions were proposed:

Why does Apple collect and compile this location data? Why did Apple choose to initiate tracking this data in its iOS 4 operating system?
Does Apple collect and compile this location data for laptops?
How is this data generated? (GPS, cell tower triangulation, WiFi triangulation, etc.)
How frequently is a user's location recorded? What triggers the creation of a record of someone's location?
How precise is this location data? Can it track a user's location to 50 meters, 100 meter, etc.?
Why is this data not encrypted? What steps will Apple take to encrypt this data?
Why were Apple consumers never affiamtely informed of the collection and retention of their location data in this manner? Why did Apple not seek affirmative consent before doing so?
Does Apple believe that this conduct is permissible under the terms of its privacy policty? See Apple Privacy Policy at "Location-based Services" (accessed on April 20, 2011), available at www.apple.com/privacy.
To whom, if anyone, including Apple, has this data been disclosed. When and why were these disclosures made?

Sen. Franken stated that, "The existence of this information stored in an unencrypted format-raises serious privacy concerns."

On April 20, 2011 Representative Jay Inslee (D-WA) issued an official statement on the issue, indicating that he would press the company for answers and noting that "current law fails to ensure consumers are protected from privacy violations." On April 22, 2011, Rep. Inslee wrote to Chairman Leibowitz, chairman of the Federal Trade Commission, calling for the Commission's "prompt attention to this important matter."

As of April 22, 2011, the Italian Data Protection Authority has opened an investigation into the matter. In addition, the Bavarian Agency for the Supervision of Data Protection (Germany) and the French Data Protection Authority had stated an intent to look deeper into the matter. On April 26, 2011, South Korea's Communications Commission also questioned Apple about location data stored on iPhone and iPad devices.

On April 22, 2011, two individuals filed a class action lawsuit against Apple in the Middle District of Florida. Allegations include violations of the Computer Fraud and Abuse Act, Fraud, Misrepresentation, and several state claims, among others.

On April 25, 2011, the Illinois Attorney General asked for a meeting with Apple to discuss privacy concerns on mobile devices.

Apple finally responded to the allegations on April 27, 2011 in a carefully worded press release. Responding to pressure from privacy groups, Apple announced three changes to iOS4: