11 Apple Privacy Problems That Might Surprise You

In November, 2022, security researchers from the software company Mysk took a look at the data iPhones send back to Apple. They found that the company collects analytics data on your use of the device even when you turn off the iPhone Analytics privacy setting.

That setting promises to “disable the sharing of Device Analytics altogether.” But in tests, the iPhone’s privacy controls didn’t have any effect on whether or not Apple’s apps harvest details about your behavior. The researchers later discovered that the data includes a unique string of letters and numbers which can identify you by name.

Shortly after Gizmodo published a story about the findings, a series of disgruntled Apple users filed four different class-action lawsuits against the company, It’s been months, and Apple still hasn’t provided any information about the analytics problem, or said anything in its defense.

When the Mysk researchers examined the analytics data the iPhone collects, the data from the App Store was surprisingly detailed. And again, turning off the iPhone Analytics setting didn’t make a difference.

In the researchers’ test, the App Store harvested information about every single thing a user did in real time, including what you tapped on, which apps you search for, what ads you saw, and how long you looked at a given app and how you found it. The researchers said the digital store’s own app sent details about you and your device as well what kind of phone you used, your screen resolution, your keyboard languages, how you connected to the internet—notably, the kind of information commonly used for device fingerprinting.

The App Store might not sound particularly sensitive, but it depends on what apps you use. If you search for apps related to your religion, sexual orientation, or mental health issues, for example, then the data getting sent back to corporate servers can reveal intimate details about your life.

Gizmodo asked the researchers to examine other Apple apps. The Health and Wallet apps were more private, but Apple Music, Apple TV, Books, the iTunes Store, and Stocks all collected similar information.

You can get a glimpse at the data collection the tests found in this video.

Apple isn’t necessarily using your data for nefarious purposes, but it’s worth understanding what kind of information the company collects.

Take location data. Your iPhone uses location data for all kinds of useful features, like giving you driving directions or tagging and organizing your photos. What you might not realize is a lot of that data is being stored for later.

Open you iPhone settings, and then go to Privacy & Security > Location Services > System Services > Significant Locations. Here, you’ll find a record of your recent travel activity, as well as places you frequently go, like your home and work addresses.

Apple does provide fine-tuned controls to disable this data collection, and the company lays out information about how it uses location data in its privacy policies. Still, it demonstrates how detailed Apple’s default data harvesting is.

Last year Apple rolled out a privacy setting called App Tracking Transparency, or ATT. You’ve seen it if you use an iPhone when apps ask for permission to track you.

ATT is a big deal. It had such a huge impact on the tech industry that it may have tilted TikTok’s war on Facebook in the Chinese app’s favor. But the setting itself only controls one specific piece of data. When you turn it on, your apps can’t collect an ID number called the IDFA, or Identifier for Advertisers. Apps aren’t supposed to sneak around and track you in other ways, but there’s little stopping them from a technical perspective. Apple says if it catches developers breaking that policy, their apps can be banned from the App Store.

But research has shown that Apple seems to be letting a lot of apps get away with tracking you anyway. Last year, a study found that turning on the setting made “no meaningful difference in third-party tracking activity.” Even after the study was published, Apple seemed slow to act.

The iPhone maker isn’t going to let big players like TikTok or Meta blatantly flaunt the rules, but so far the company’s enforcement efforts against smaller players seems lackluster. In other words, your iPhone may not be as private as Apple suggests.

A study from Trinity College Dublin examined Apple’s data collection last year and found, among other problems, that the company collects data that could be used to track the people you spend time with.

The research found that when you have WiFi on, you iPhone sends the Wifi MAC addresses of all the other devices on your network. If you have location services turned on, the data includes precise GPS information, the study said. That means that if Apple wanted to, it could identify anyone who’s in close proximity to you, friends, family, coworkers or otherwise.

“In particular, it is disappointing to see that so much handset data is being collected by Apple,” said Doug Leith, the Trinity College professor who conducted the study, in an interview with ScienceX. “I think iPhone users often believe that their handsets offer greater privacy than Android handsets, and certainly Apple themselves make great play of the importance of privacy. Yet our study finds that Apple collects pretty much the same sort of data as Google.”

One of the best things about iMessage—aside from the beloved blue texts—is that your conversations are encrypted end-to-end. That means only the sender and receiver can see the actual contents of a message, and anyone who tries to intercept it in between is out of luck, even Apple.

However, that’s only true if you’re texting with another iPhone user. If you’re chatting with one of the hundreds of millions of people who has an Android phone, iMessage sends out your chats in regular, unencrypted SMS, an ancient format that’s rife with security concerns.

Google, the maker of Android, has been trying to collaborate with Apple to solve this problem by adopting a new standard for texts. But so far, Apple has refused. A reporter asked Tim Cook when Apple was going to fix the issue, he quipped that, if you’re worried about it, you should “buy your mom an iPhone.”

Apple could also just make an iMessage app for Android, but it probably won’t. If you’re wondering why, there’s a simple answer: competition. A lawsuit accusing Apple of monopolistic practices uncovered emails between executives discussing the potential change. They make it clear that part of Apple’s iMessage strategy is to trap iPhone users.

In an email, Apple’s senior vice president of software engineering, Craig Federighi, said, “iMessage on Android would simply serve to remove [an] obstacle to iPhone families giving their kids Android phones.” Another Apple employee said elsewhere that “the #1 most difficult [reason] to leave the Apple universe app is iMessage... iMessage amounts to serious lock-in.”

Addressing this issue would be an easy way to make a dramatic privacy improvement for Apple users, some of whom have spent tens of thousands of dollars on the company’s products. Instead, Apple seems like it’s intentionally perpetuateing the problem.

You probably don’t think “advertising” when you hear the name Apple in the same way you do for Instagram, Facebook, or Google, but that may change in the future. After kneecapping other tech companies that make their money on ads, Apple quietly started building out its own advertising network. The company has slipped more ads into the App Store, wants to bring ads to Apple TV, and is reportedly working to poach ad tech engineers from other companies.

Guess what’s fueling all of those ads? Your personal data. Apple doesn’t do a ton of targeted advertising so far, but you see it in the App Store, and there are a lot of indications that more is on the way.

For its targeted advertising system, Apple uses your name, location, address, age, gender, the other ads you’ve seen, the products and services you use, things you search for in Apple apps and more. It uses all of that data to assign you into different advertising audience segments. The company also uses that data to provide advertisers with aggregated reports about how well their campaigns are working.

Apple’s ad system is slightly more private than a lot of other companies’ advertising platforms, and it promises not to share personally identifiable information with third parties. But don’t think for a second that your data isn’t getting sent back to Apple’s servers.

According to Apple, what it’s doing doesn’t count as “tracking” because Apple only collects data about what people do the company’s own products. Whatever you say, Cupertino.

Here’s another find from researchers at Mysk. If you’re nerdy enough about your privacy, you can set up a VPN on your iPhone to mask your web traffic. Unfortunately, Mysk researchers found that isn’t going to protect your from Apple. In a test, they discovered that Apple circumvents your device’s VPN to collect data about your activity. You can see it happen in real time in the video bellow.

Back in 2021, Apple announced iOS 15, the latest update to its mobile operating system. Among a slew of changes, the company’s cheerful employees announced some privacy improvements to Siri during Apple’s annual World Wide Developer’s Conference

“Today we’re introducing on-device speech recognition. This means that, by default, your audio is all processed right on your iPhone or iPad,” said Katie Skinner, Apple’s manager of user privacy software. “This addresses the biggest privacy concern we hear for voice assistants, which is unwanted audio recording.”

What Apple didn’t mention is that while your audio recordings may not leave your phone, transcripts of your conversations always do. Skip Apple’s flashy video presentation and head to the privacy policy. There, you’ll learn that “In all cases, transcripts of your interactions will be sent to Apple to process your requests.”

Should you be worried about this? Not necessarily. There’s no reason to assume Apple engineers are going to be pouring over your chats with Siri. But it’s another instance where Apple’s practices aren’t quite as private as you might think at first glance. One privacy-minded reader wrote into Gizmodo to complain about this issue. He bought a new iPhone specifically for the on-device Siri processing. But when he realized Apple can learn just about anything it wants to know about his voice assistant usage, he decided he wasn’t comfortable using Siri after all.

Apple wants to lock you into its ecosystem—not just your phone and computer, but the apps you use, too. One reason is all of that delicious data.

Take the Apple Music app. Unfortunately, music streaming has become yet another opportunity for companies to spy on you, and Apple is no exception. These practices aren’t a secret, but you have to go a little out of your way to learn about them. Head to the App Store and look up the Apple Music app. You’ll find that the company admits it uses a whole lot of information about your music listening habits for advertising.

The same goes for the Books app, the Stocks app, Apple TV and more. Is Apple selling this data? No. But a lot of users probably see Apple saying things like “Privacy. That’s iPhone,” and assume they don’t have to worry about their data being used against them in an ad.

In early January, France’s data protection authority, the CNIL, fined Apple $8.5 million for illegally harvesting iPhone owners’ data for targeted ads without proper consent.

According to the CNIL, Apple did not “obtain the consent of French iPhone users (iOS 14.6 version) before depositing and/or writing identifiers used for advertising purposes on their terminals.”

The CNIL’s case unveiled interesting details about the company’s targeted ad program, as reported in the ad industry blog MobileDevMemo. Apple uses a unique ID number tied to your iCloud account called a DSID to sort you into a special segment used for ad targeting, attaching it to information about your location, age, and gender. (The DSID the same one the Mysk researchers saw transmitted in analytics data that Apple swears is anonymous.)

The company also harnesses a separate ID number that’s only for ads called the iADID, and another that’s specifcally meant to tie your activity together across all the different devices you use. Every time you see an ad on an Apple product or service, it seems that this data is sent back and fourth.