iSpy: Apple’s Latest System Update and It’s Privacy Features

iSpy: Apple’s Latest System Update and It’s Privacy Features

This summer, Apple announced the newest version of its operating system, iOS 14.^[1] These changes highlight the company’s commitment to privacy and provide users with more control over their information.^[2]

Privacy by Design is a concept that, at its core, aims for privacy to become a proactive measure embedded in the design of technology systems and business practices throughout the entire lifecycle of data use.^[3] It encourages creators to keep the interests of individuals as the top priority and for privacy assurance to be an organization’s default mode of operation.^[4] While Apple’s new privacy features are in line with the concept of Privacy by Design, this recent update has underscored the need for a uniform standard through a comprehensive federal data protection bill.

Apple Update: What’s New?

Apple’s iOS 14 update brings an array of changes that gives users more control over their information.^[5] Mobile applications (“apps”) are now required to request permission to access a user’s location. Users now have the option to provide apps with their approximate location, in addition to the previous options of granting or denying access to exact location data.^[6] Apple has recognized that not every application needs to know a user’s precise location. For example, if someone wants to check the weather or read local news articles, the app only needs to the know what city the user is in to fulfill the request—knowing the precise location of the user serves no critical purpose.^[7] Users are also able to control the access apps have to their photos and can select the photos they want to share, as opposed to the previous all-or-nothing approach.^[8] Additionally, a recording indicator will alert users when an app has accessed the device’s camera or microphone.^[9] Safari, Apple’s browser, blocks all third-party cookies, which means, by default, no advertiser or website is able to follow a user around the internet using commonplace tracking technology.^[10] Additional features include clipboard access transparency and new access controls for devices in the home and on other local networks.^[11] These features allow users to decide what they want to give companies and third-parties access to, for how long, and according to the unique desires of each user.

Where Is the Problem?

While Apple’s most controversial update is still aimed at providing users with more control over their data, it places a greater burden on developers and, ultimately, on users. Included in the update is a new option for users to disable tracking between different apps, requiring developers to ask for permission before tracking a user across an app.^[12] Apple defines “tracking” as “linking user or device data collected from an app with user or device data from other companies’ ‘apps, websites, or offline properties’ for targeted advertising.”^[13] Tracking is enabled through a number of tools, such as user profiles, digital fingerprinting, or the use of the Identifier for Advertisers (“IDFA”).^[14] The IDFA is a unique identifier that allows advertisers to precisely track and target users within apps on iOS devices.^[15] The IDFA allows advertisers to indefinitely track user interaction and use that information to build user profiles that are attached to a device.^[16] Starting in early 2021, Apple will require developers to affirmatively request access to users’ IDFA’s through Apple’s “AppTrackingTransparency” Framework.^[17] A user must grant or deny the app permission before they begin downloading or using the app.^[18] Additionally, Apple’s App Store will require developers to institute a privacy label, comparable to food nutrition labels, that discloses information about their privacy practices, prior to a user downloading that developer’s app.^[19] If the app uses any third-party code, the developer will need to disclose what data the third-party collects, how the data is used, and whether that data is used to track users across platforms.^[20]

Due to Apple’s transparency measures, users have the power to decide whether they want to grant a developer access to information and whether they trust each app’s practices. Herein lies the problem­: the changes to how app developers are able to access information about users are essential, but ultimately place the burden on consumers. The privacy label is a great way for developers’ data collection and use practices to be made transparent. However, this might not provide the average consumer with enough information to make an informed decision. Studies have yielded mixed results: some users do not mind being tracked by advertisers, provided they receive a benefit from it, while others lack trust in these third-party companies and want to control who has access and when.^[21] The responsibility of protecting consumer information should not fall on individual companies. If this trend continues, the ultimate burden will be placed on consumers to be vigilant about protecting their information and determining which brands, companies, or services to entrust with it. While the privacy features offered by Apple are a great example of Privacy by Design, the rights of consumers to privacy and data protection cannot alone be based on individual company policies.

So, What Now?

Apple’s new privacy features were created with privacy in mind and provide greater transparency for users. The new privacy framework moves closer towards some of the important privacy and data protection laws that have been enacted elsewhere across the globe.^[22] The European Union’s General Data Protection Regulation (GDPR) is often seen as the gold standard. The GDPR has enshrined the concept of Privacy by Design in Article 25 by requiring companies to implement “appropriate technical and organizational measures” which meet the principles of data protection by design and data protection by default.^[23].

The United States, in contrast, has yet to pass a comprehensive federal data protection bill which has left states with the job of creating data protection rights for its citizens. California has led the way with the California Consumer Privacy Act. The Act gives California residents greater control over their information and allows them to opt-out of data collection and stop a company from selling their data to third-parties.^[24] Proposition 24 is on California’s ballot this election and is also in line with some of Apple’s policies.^[25] It would similarly allow consumers to limit the information collected by businesses, like a ride share user’s race or a weather app user’s exact location.^[26] New York, Maine, and Nevada are among the states that have passed comprehensive privacy laws, while many states including Washington and Illinois are currently in the legislative process of doing so.^[27] While state and company-specific efforts are a step in the right direction, there is still a glaring need for comprehensive federal privacy and data protection laws, and the sooner they are enacted, the better. Consumers are faced with a growing number of concerns and choices about their personal information and how companies use their data. In order to ensure uniform policies and compliance, the federal government needs to regulate the industry. This, in conjunction with companies embodying the principles of Privacy by Design, will ensure that individual rights to privacy and data protection are safeguarded.