Say It Ain't So, Steve: News of Apple's Tracking Inflames Do Not Track Legislation

By Stephanie Jordan
in

The notion of spyware is not new. The issues of stealth tracking of late that has led to the Do Not Track movement and legislative efforts could be seen as today’s continuation of anti-spyware work to protect users from unknown technologies being placed in products or added without consent. It wasn’t that long ago that the Anti-Spyware Coalition along with the anti-spyware community worked on guidelines to help software developers avoid publishing products likely to be unwanted by consumers.

What makes the news last month that Apple has tracked and logged user location information unsettling for me is the fact that it is Apple that is guilty of it. Apple is supposed to be “the other guys”—you know the ones that are so friendly. The Apple brand is kinda counter-culture with that original multi-rainbow apple logo. A company that is more about customer love than most.

While the collection of user location data by Apple’s iOS-based devices was a surprise to many, there were others that have been using the information to conduct forensic investigations for more than a year. So the researchers that “discovered” the files stored on iPhones, IPads and iPod Touches is sort of like Columbus “discovering” the new world, while there were people already there. They do get credit for getting the word out to the masses, however.

Hearing subsequently that Google’s Android also regularly tracks and logs location data did not come as a surprise. Google has already been in skirmishes that have led to questions of privacy invasion. In fact, Google’s first quarter lobbying bill is higher this year than ever before, as the company spent $1.48 million USD to make its positions known with policymakers and regulatory bodies. Google has had a lobbying office in Washington since 2005, but is steadily spending more and more there. This quarter’s lobbying bill is 7 percent higher than last year at this time.

Legislators are definitely on the online privacy bandwagon. The Federal Trade Commission’s report, “Protecting Consumer Privacy in an Era of Rapid Change,” proposed a Do Not Track mechanism last December. Since then Rep. Jackie Speier, D-CA, has introduced HR 654, the Do Not Track Me Online Act. In California Sen. Alan Lowenthal, D-Long Beach, has introduced SB 761, a bill that would establish a Do Not Track mechanism for companies doing business in California.

This legislation would impact makers of mobile devices, but also companies like Facebook and all others that collect data during online computer activities. Proponents of Do Not Track think that online tracking is a violation of privacy rights pointing out that it is illegal to have phone calls recorded or be stalked in brick-and-mortar stores. Such protections should extend to online too, they believe.

Lowenthal’s “Do Not Track” was given the nod to move forward this month as the California Senate Judiciary Committee voted to send the bill forward by a 3-2 vote. Speier’s bill in Washington is facing uncertain prospects.

Regardless how these bills proceed, as I mentioned in January predictions for 2011, privacy is a big issue this year. A poll by Consumer Watchdog found that 90 percent of Americans want legislation to protect their online privacy, and 80 percent support a Do Not Track mechanism. Another 86 percent want a single-click button on their browsers that makes them anonymous when they search online.

“The mobile world is the wild west of the Internet where these tech giants seem to think anything goes,” says John M. Simpson of Consumer Watchdog. “Consumers need the same sort of strong privacy protections whether they go online via a wired device or a mobile device.”

Last week the Senate Judiciary Privacy, Technology and the Law subcommittee, chaired by Sen. Al Franken, D-MN, held a hearing with the focus of “protecting mobile privacy”. The Center for Democracy & Technology’s Project on Consumer Privacy Director Justin Brookman testified before the subcommittee saying, “We need a data privacy law that incentivizes and requires companies to provide clear and conspicuous notice to consumers about the use of their information and provides for meaningful control of that information. Moreover, companies should collect only as much personal information as necessary, be clear about with whom they’re sharing information, and expunge information after it is no longer needed.”

For its part, Apple earlier this month broke its initial silence on the issue of the location data collection when it issued an update to its iOS calling it a “bug” fix to modify the length of time the data is stored, from up to a year to now keeping the data for only seven days. The update is also fixing a programming bug that caused the phones to continue getting the data, even after the turn-off location services was employed.

According to Apple, its tracking of latitude, longitude and timestamps via cell tower and Wi-Fi locations is being used “to help Apple maintain and update its database” of location-based information. The location files that also reside on the device, unencrypted, and on computers, in which the devices are synced, is of concern to privacy experts.

Is knowing the location of a user that big of deal? While some say, no, others are more cautious. “Location data is especially sensitive information that can be used to decipher revealing facts or put people at physical risk,” believes Brookman. “Location information could disclose visits to sensitive destinations, like medical clinics, courts and political rallies. Access to location can also be used in stalking and domestic violence. Finally, as an increasing number of minors carry location-capable cell phones and devices, location privacy may become a child safety matter as well.”

The news of Apple’s tracking came almost to the day as the company announced a record quarter with 4.7 million iPads and 18.7 million iPhones sold. 

Published May 19, 2011