Is Apple spying on us through iTunes?

[rmeister0]

It doesn't matter if it is a third party or not. I don't think most people would make the assumption that iTunes is sending data back to someone else's computer about what tracks you're playing.

I have not given Apple permission to gather data on my listening habits. My buying habits - yes, IF I buy from ITMS. But not my listening habits, AND I HAVE NEVER BEEN ASKED IF I WANT TO OR NOT.

PR nightmares are about perceptions, not facts. The perception here is not a good one, and given Apple's dominance of the legal download market this makes them a bigger target for litigious-happy lawyers be they government or private.

[Brian]

Originally Posted by rmeister0

I have not given Apple permission to gather data on my listening habits. My buying habits - yes, IF I buy from ITMS. But not my listening habits, AND I HAVE NEVER BEEN ASKED IF I WANT TO OR NOT.

This apparently isn't the case, and they aren't collecting data on listening habits. According to Apple, the data is discarded after it is used to show "More From" and "Listeners Also Bought" information in the Mini-Store.

[Alexander Turcic]

I think the "issue" will be solved relatively quickly... Apple has already stated that they are not using the data for anything but showing related information in the Mini-Store. And if I was Apple, I'd release an iTunes upgrade to add more transparency (i.e. inform the user).

[Colin Dunstan]

Small update: According to various Boing Boing readers every click on a song transmits not only the song title and artist but also your personal Apple ID.

Apple ID's are unique to every individual and are used for all of Apple's services -- iTunes, .Mac, Apple Care, OS X registration, pro application use, the online Apple Store, the Apple Developer Connection, and so on.

[Zire]

Originally Posted by Colin Dunstan

Small update: According to various Boing Boing readers every click on a song transmits not only the song title and artist but also your personal Apple ID.

Apple ID's are unique to every individual and are used for all of Apple's services -- iTunes, .Mac, Apple Care, OS X registration, pro application use, the online Apple Store, the Apple Developer Connection, and so on.

That's sad...I'm glad that I don't have an Apple ID...

[since1968]

Hi guys,

I'm Marc A. Garrett, the person who originally reported the iTunes privacy issue on since1968.com. I came across your forum when it appeared in my referer logs. Sorry I'm coming a bit late to your discussion.

Brian, I think some of your skepticism is warranted: some of the blog discussion has moved beyond the initial assertions I've made. Still, I'd push back on a few points made you made:

First, your reading of the TOS [there are three documents covering iTunes, iTMS, and Privacy; for the sake of brevity I'll refer to them all as the Terms of Service] is so expansive that I wonder what you think it prohibits? I would argue that the plain language of the various agreements covering iTunes and iTMS is designed to reassure the user that the type communication going on between iTunes and Omniture is prohibited.

Second, if this type of behavior is clearly contemplated in the TOS, why try to obfuscate it? I haven't had one person defending Apple's behavior -- not a single one -- explain to me why an HTTP GET call to 2o7.net should be buried behind a 192.168[etc] prefix that's designed to look like traffic on the local network. I concede there could be a perfectly good explanation, but no one has come up with one.

Third, I was restrained in my initial coverage because I couldn't be sure that Apple sent uniquely identifying information to a third party -- what I mean to say is that I knew iTunes was sending data, but I did not want to make public claims about the nature of the data until I could confirm it for myself. But it turns out that the reporting about unique IDs is correct: iTunes sends your X-Dsid to Omniture. This X-Dsid is unique; not unique in the sense of a PHP session variable, but unique in the sense that it is the numeric equivalent of your Apple ID. It is the number that Apple uses to retrieve your contact and billing data, and it is the same number which Apple sends to Omniture in clear text.

Finally, let's assume Apple is telling the truth about "Apple doesn't collect data." That doesn't address whether Omniture collects that data. No one has answered this to my satisfaction either: why does iTunes send your unique ID to a data analytics firm if that data is not used or stored?

I'd be happy to share all of my data and methods with you guys. It looks like you have a good community here and I'm glad I stumbled across it.

Best,

Marc A. Garrett
since1968.com

[Brian]

Originally Posted by since1968

Hi guys,

I'm Marc A. Garrett, the person who originally reported the iTunes privacy issue on since1968.com. I came across your forum when it appeared in my referer logs. Sorry I'm coming a bit late to your discussion.

Thanks for stopping by and sharing your thoughts.

Originally Posted by since1968

Brian, I think some of your skepticism is warranted: some of the blog discussion has moved beyond the initial assertions I've made. Still, I'd push back on a few points made you made:

First, your reading of the TOS [there are three documents covering iTunes, iTMS, and Privacy; for the sake of brevity I'll refer to them all as the Terms of Service] is so expansive that I wonder what you think it prohibits?

That's my point. There are enough catch-all phrases that, although it isn't specifically stated, I think the language does cover the type of activity going on in the case of the Mini-Store.

Originally Posted by since1968

I would argue that the plain language of the various agreements covering iTunes and iTMS is designed to reassure the user that the type communication going on between iTunes and Omniture is prohibited.

While there is plain language and specific examples of activity cited in the TOS/SLA/PP, again I'd argue that certain catch-all language technically/legally covers them. From Apple's Privacy Policy, for example:

There are also times when it may be advantageous for Apple to make certain personal information about you available to companies that Apple has a strategic relationship with or that perform work for Apple to provide products and services to you on our behalf. These companies may help us process information, extend credit, fulfill customer orders, deliver products to you, manage and enhance customer data, provide customer service, assess your interest in our products and services, or conduct customer research or satisfaction surveys. These companies are also obligated to protect your personal information in accordance with Apple’s policies. Without such information being made available, it would be difficult for you to purchase products, have products delivered to you, receive customer service, provide us feedback to improve our products and services, or access certain services, offers, and content on the Apple website.

In my opinion, that covers the Mini-Store sending data to provide a service by "assessing your interest in our products and services" and Overture is bound by Apple's Privacy Policy as a strategic partner.

Originally Posted by since1968

Second, if this type of behavior is clearly contemplated in the TOS, why try to obfuscate it? I haven't had one person defending Apple's behavior -- not a single one -- explain to me why an HTTP GET call to 2o7.net should be buried behind a 192.168[etc] prefix that's designed to look like traffic on the local network. I concede there could be a perfectly good explanation, but no one has come up with one.

That is potentially worrisome, but I wouldn't automatically attribute it to an attempt at obfuscation.

Originally Posted by since1968

Third, I was restrained in my initial coverage because I couldn't be sure that Apple sent uniquely identifying information to a third party -- what I mean to say is that I knew iTunes was sending data, but I did not want to make public claims about the nature of the data until I could confirm it for myself. But it turns out that the reporting about unique IDs is correct: iTunes sends your X-Dsid to Omniture. This X-Dsid is unique; not unique in the sense of a PHP session variable, but unique in the sense that it is the numeric equivalent of your Apple ID. It is the number that Apple uses to retrieve your contact and billing data, and it is the same number which Apple sends to Omniture in clear text.

You're initial and subsequent coverage and questions are all responsible and valid in raising potential privacy concerns, but not everyone has been as responsible or level headed in their coverage.

Originally Posted by since1968

Finally, let's assume Apple is telling the truth about "Apple doesn't collect data." That doesn't address whether Omniture collects that data. No one has answered this to my satisfaction either: why does iTunes send your unique ID to a data analytics firm if that data is not used or stored?

As I mentioned above, as a strategic partner with Apple, they're bound by Apple's privacy policy. You do raise several legitimate questions that should be addressed, but as I pointed out earlier, the way I read their policies they're covered.

Transparency is the best policy, and in this case, I agree that Apple has fallen short.

Originally Posted by since1968

I'd be happy to share all of my data and methods with you guys. It looks like you have a good community here and I'm glad I stumbled across it.

Thanks again Marc,

[MrSaint]

Wow, thanks Marc for joining and making your point clear to us! Having read your initial post, and the various responses, including Brian's, I come to the conclusion that

a) Apple has covered their ass by including the necessary details in their TOS/SLA/PP policies

b) Apple is not 100% true about why and how they collect the data through iTunes; after all, transmitting the X-Dsid/Apple ID would not be necessary for finding context-related music material on Mini-Store.

[Brian]

Thanks to Marc's original article that brought this issue to light, it appears that Apple has responded to ease privacy concerns about the Mini-Store. Marc just posted this on his blog, with details about how Apple has partially fixed the Mini-Store privacy issue in iTunes:

Now, when you attempt to open the iTune MiniStore you are prompted with the following language:

The iTunes MiniStore allows you to discover new music and videos right from your iTunes Library. As you select items in your Library, information about that item is sent to Apple and the MiniStore will show you related songs or videos. Apple does not keep any information related to the contents of your music Library. Would you like to turn on the MiniStore now?

You don’t need to download any additional software to see the new Privacy language. Thus, Apple has addressed two of my primary concerns:

* The MiniStore is now opt-in instead of opt-out; in other words, a user can choose whether she wishes to use this feature but by default the feature is turned off.
* The interface now states in unambiguous language that some of your information is sent to Apple.

Apple should be commended for updating iTunes within a week of my original article.

[MrSaint]

Brian, that was the good part. Apple did respond in quick manner. However, transmitting your Apple ID still seems important to them:

Packet inspection with Ethereal indicates that—assuming you use iTunes on a Mac—iTunes still includes your Apple ID in the header of an HTTP GET sent to Omniture, a third party marketing, data collection, and web analytics firm. It’s up to Apple’s customers to decide whether Apple should update the licenses governing iTunes and iTMS to disclose its use of third party software and services as it does with GraceNote and Kerbango.

[Bob Russell]

Originally Posted by Alexander

I think the "issue" will be solved relatively quickly...

Good call Alex! Brian and Mr Saint are on top of the news. It's also at Boing Boing now as a post called "Apple changes iTunes, now obtains consent before collecting info". He refers to the new message Apple included and makes the following comments

That's pretty good news, but I'd still like to know why Apple is transmitting my Apple ID number with the data collected.
Still, this is the right thing for Apple to have done (and what they should have done in the first place) -- good job, Apple.