Apple Faces Second Class-Action Suit Over Privacy Settings After Gizmodo Story

The iPhone Analytics privacy setting promises that Apple won’t collect usage data if you turn it off. In early November, Gizmodo exclusively reported on research demonstrating that Apple collects that analytics data whether or not the setting is on. We reached out to Apple, but the company didn’t respond.

We contacted Apple again when a California iPhone user filed a class-action lawsuit over the problem, and again when additional tests confirmed that the data includes personally identifiable information—contrary to another Apple policy. Apple didn’t respond.

On Friday, another iPhone user filed a second class-action lawsuit against Apple about the analytics privacy problem, this time in Pennsylvania. As of press time, Apple hasn’t responded to a request for comment.

It’s been months, and Apple hasn’t addressed what seems like a direct contradiction of its privacy policies, not to mention a years-long PR campaign about the company’s commitments to data protection, complete with catchy promises like “Privacy. That’s iPhone.” and “What happens on your iPhone, stays on your iPhone.”

Apple’s practices constitute “systematic violations of state wiretapping, privacy, and consumer fraud laws,” the new lawsuit reads. “Quite simply, Apple unlawfully records and uses consumers’ personal information and activity on its consumer mobile devices and applications (‘apps’), even after consumers explicitly indicate through Apple’s mobile device settings that they do not want their data and information shared.”

The iPhone Analytics privacy setting says that it will “disable the sharing of Device Analytics altogether” when you turn it off. Apple’s analytics privacy policy goes onto say that “none of the collected information identifies you personally.” But when researchers from the software development company Mysk tested those claims, they found that neither was true.

Mysk’s tests showed that turning off the setting had no effect on analytics data sent from Apple apps. That data includes detailed real-time information about everything you’re doing in certain apps, not only things you type or tap on, but even how long you spend on certain pages and which ads you see. A primary example is the App Store, where searches and downloads for specific apps can reveal anything from users’ sexual orientation, to religion to sensitive problems like addiction and substance abuse.

Despite Apple’s claims that the information isn’t identifiable, that data is transmitted with a permanent ID number tied to iCloud accounts, which links the data to your name, email address and phone number.

The company faces growing scrutiny over its harvesting of personal information. Last week, Apple was fined $8.5 million dollars in France for collecting data for targeted ads without getting users’ consent. It’s unusual for privacy regulators to ding Apple, and in all fairness its privacy practices are often more protective of users than many tech competitors. But that may change in the near future as Apple ramps up a burgeoning advertising business, an enterprise that necessitates data collection.