Is Apple spying on us through iTunes?

[Colin Dunstan]

Ever since the Sony rootkit debacle we know that music played on a connected computer is not safe from data mining. According to Marc at Since1968, the latest incarnation of iTunes sends information to Apple whenever you double-click on a song. Apparently Apple uses this information to find albums and tracks for sale by the artist whose song was presently playing.

This means, of course, that every single time I play a song the information is sent back to Apple. You can turn off the MiniStore at the click of a button, but it's not clear whether turning off the MiniStore is the same as turning off the flow of data (one doubts it). And don't bother looking for a way to turn this "feature" off in the Preference pane: it’s not there.

And as a user at Boing Boing stated:

I just ran a packet trace of the new iTunes - it only connects to Apple if the Mini Store is open. For regular MP3s, it'll run a full text search to find related articles, for purchased music, it searches by the original product ID. Sample query string is: /WebObjects/MZSearch.woa/wa/ministoreMatch?an=Daft% 20Punk&gn=Electronic&kind=song&pn=Discovery

The problem: Apple collects your data without your knowledge or consent. And who knows, perhaps the next iTunes will only support RIAA-approved MP3s.

[via Boing Boing]

[johnsoax]

And people wonder why as a Mac user since the beginning (my first was a LCII, used an Apple IIc before that), I don't use an iPod .

I've never trusted the RIAA and the sway they have with Apple. All of my music (even the music I buy from iTunes) is in un DRM'ed MP3 so that I can play it on anything I want. I can always go back to Maccast for my MP3 player (maybe I can't, they seem to have disappeared).

[Brian]

Originally Posted by Colin Dunstan

The problem: Apple collects your data without your knowledge or consent. And who knows, perhaps the next iTunes will only support RIAA-approved MP3s.

Is Apple really collecting data without your knowledge or consent? I highly doubt Apple legal wouldn't put language in the iTunes EULA, iTMS Service Agreement, and Privacy Policy that would cover them by notifying the user that they may collect certain information when the user agrees to using their software and services.

Don't forget, when you install iTunes and use the iTMS, the user has to agree to these terms. Whether or not people read them and fully understand them before agreeing to them is another story.

[Colin Dunstan]

Brian did you check out the Boing Boing post I was referring to? It appears that Apple did not mention that they would collect this kind of information; in fact, this Marc guy points out,

We all know that Apple uses GraceNote to grab iTunes track info. But this is precisely my point: Apple’s use of GraceNote is transparent. When you rip a new CD, iTunes tells you that it’s querying the GraceNote database. Not only that, Apple had the good sense to be clear about GraceNote in the iTunes EULA. As of this writing (01/11/06 3:30pm EST), no publicly available Apple EULA mentions Omniture. According to Google, the only mention of Omniture on Apple's web site is a couple job openings and a copyright notice for the King Kong trailer. Apple clearly felt bound to include GraceNote in its iTunes EULA. Why not Omniture? Why one standard of transparency for Company A and a different standard for Company B?

There's also an updated post on what's behind Omniture, which appears to be some kind of marketing firm.

[rmeister0]

We know that data goes back to the ITMS to get a sales recommendation; we do not know if that data is actually 'collected' or stored in a persistent manner.

This functionality comes in an update that does not present a new EULA if it is installed over an existing iTunes version. Thus, there is no disclosure of this.

This has the potential to be more dangerous for Apple than it normally would be for other companies, given their pro-consumer image and their dominance of the portable mp3 player market. While I don't think what is actually going here is anything terrible or worrisome, it is the implications of where this approach could go and the lack of proper disclosure that will create any PR headaches this causes.

At this point in time, turning off the Mini Store solves the problem completely.

[Brian]

Originally Posted by Colin Dunstan

Brian did you check out the Boing Boing post I was referring to? It appears that Apple did not mention that they would collect this kind of information; in fact, this Marc guy points out,

I'm not apologizing for Apple not adding specific language in the SLA, Privacy Policy, and TOS to cover the Mini-Store sending data, but as I read all three, there are enough "catch-alls" to cover themselves in this situation.

Here's one section that has some catch-all language, as mentioned in post #9 to this story (Emphasis is mine):

“There are also times when it may be advantageous for Apple to make certain personal information about you available to companies that Apple has a strategic relationship with or that perform work for Apple to provide products and services to you on our behalf. These companies may help us process information, extend credit, fulfill customer orders, deliver products to you, manage and enhance customer data, provide customer service, assess your interest in our products and services, or conduct customer research or satisfaction surveys. These companies are also obligated to protect your personal information in accordance with Apple’s policies. Without such information being made available, it would be difficult for you to purchase products, have products delivered to you, receive customer service, provide us feedback to improve our products and services, or access certain services, offers, and content on the Apple website.”

[rmeister0]

That Apple would retain data on what you purchase from their store is reasonable.

That Apple would accumulate data on what you are playing in iTunes, even material you did not purchase from from the ITMS, is not reasonable. That's what people are getting irritable about.

[Brian]

Originally Posted by rmeister0

That Apple would retain data on what you purchase from their store is reasonable.

That Apple would accumulate data on what you are playing in iTunes, even material you did not purchase from from the ITMS, is not reasonable. That's what people are getting irritable about.

"Reasonableness" is highly subjective. What one person may find reasonable and agree to in an EULA might be unreasonable and objectionable to someone else.

[Brian]

I really think this is being blown out of proportion. It's fairly obvious to the user that information about the song that is currently being browsed in the Library is being received by Apple in order to display "More from" and "Listeners Also Bought" (See attached thumbnail). Don't like it, shut off the Mini Store and no data is sent. Still don't like it for ideological reasons, don't use iTunes.

[Colin Dunstan]

I am not sure if this is indeed blown out of proportion. Fact is Apple is sending data of every song you click on to a 3rd party's server, and didn't explicitely mention it nor ask for your permission. Take Microsoft's Media Player, for instance. The following dates back to 2002:

The changes follow a recent FTC settlement, in which Microsoft agreed to 20 years of government oversight of consumer privacy policies and procedures. Last year, 14 consumer and privacy groups filed a complaint with the FTC, alleging that Microsoft's online Passport authentication system violated Section 5 of the Federal Trade Commission Act... Windows Media Player 9 Series may be one of the first new Microsoft products so clearly putting privacy policies and controls in the hands of consumers. Unlike competing products or earlier versions of Microsoft's media player, the privacy policies and settings option is the first thing a consumers sees the first time the product is started... Privacy and media players are an increasingly hot item--and not just for U.S. regulators. The European Union, for example, is looking into regulating media players with respect to privacy. Microsoft's increased emphasis on privacy could help the company in Europe, particularly since the EU last year expanded an ongoing antitrust investigation to include media players."

It was a big deal to Microsoft, and it should be a big deal to Apple if they doesn't want to get into the same kind of trouble.

[Brian]

Originally Posted by Colin Dunstan

Fact is Apple is sending data of every song you click on to a 3rd party's server, and didn't explicitely mention it nor ask for your permission.

Is that a fact? From what I've read and from what you quoted from a user at BB, it sounds like only the Product ID or artist/title/genre/kind of the track is going directly to Apple, not a 3rd party server, and ONLY IF the Mini-Store is visible, ONLY when a track is clicked, NOT for every song played.

Originally Posted by Colin Dunstan

And as a user at Boing Boing stated:

I just ran a packet trace of the new iTunes - it only connects to Apple if the Mini Store is open. For regular MP3s, it'll run a full text search to find related articles, for purchased music, it searches by the original product ID. Sample query string is: /WebObjects/MZSearch.woa/wa/ministoreMatch?an=Daft% 20Punk&gn=Electronic&kind=song&pn=Discovery

[Colin Dunstan]

Originally Posted by Brian

Is that a fact? From what I've read and from what you quoted from a user at BB, it sounds like only the Product ID or artist/title/genre/kind of the track is going directly to Apple, not a 3rd party server...

This screenshot doesn't look faked, so yes, I believe it's a fact. A whois on 207.net reveals:

Organization:
Omniture Inc.
Omniture DNSAdmin
550 E. Timpanogos Circle
Orem, UT 84097
US
Phone: 801-722-7000
Fax..: 801-722-7001
Email: dnsadmin@omniture.com

And from what I can tell, Omniture is not a subsidiary of Apple, so yes, it's a 3rd party.

... and ONLY IF the Mini-Store is visible, ONLY when a track is clicked, NOT for every song played.

iTunes launches with the Mini-Store open, and either way, this does not address the issue of privacy transparency.

[Brian]

Originally Posted by Colin Dunstan

This screenshot doesn't look faked, so yes, I believe it's a fact. A whois on 207.net reveals:

Organization:
Omniture Inc.
Omniture DNSAdmin
550 E. Timpanogos Circle
Orem, UT 84097
US
Phone: 801-722-7000
Fax..: 801-722-7001
Email: dnsadmin@omniture.com

And from what I can tell, Omniture is not a subsidiary of Apple, so yes, it's a 3rd party.

OK, so it's a third-party partner of Apple's. They're bound by Apple's privacy policy, and in their privacy policy, Apple states this:

“There are also times when it may be advantageous for Apple to make certain personal information about you available to companies that Apple has a strategic relationship with or that perform work for Apple to provide products and services to you on our behalf. These companies may help us process information, extend credit, fulfill customer orders, deliver products to you, manage and enhance customer data, provide customer service, assess your interest in our products and services, or conduct customer research or satisfaction surveys. These companies are also obligated to protect your personal information in accordance with Apple’s policies. Without such information being made available, it would be difficult for you to purchase products, have products delivered to you, receive customer service, provide us feedback to improve our products and services, or access certain services, offers, and content on the Apple website.”

Bottom line: Should Apple make this clearer ? Yes, and they probably will, especially after this. Are they violating their own privacy policy, SLA, and TOS? In my opinion, no.

Apple has told Macworld that the data is discarded after the Mini-Store is updated.

The good news is, Apple tells us that the information is not actually being collected. The data sent is used to update the MiniStore and then discarded. If you think about it, this makes sense—imagine the size of the data files they would accumulate with millions of users and what must be hundreds of millions of songs played each day. But Apple should tell us as much, so that we can all relax a bit about sharing our listening habits with Apple.


Apple should amend iTunes to clearly disclose what data the program is transmitting and how it’s being used. There should be a dialog box that pops up the first time iTunes runs, explaining exactly how the MiniStore works. If Apple had just included that yesterday — or even some information in the Read Me, then I wouldn’t have even raised this as an issue. A little transparency and openness can go a long way to easing privacy fears.

Agreed.

[Colin Dunstan]

Originally Posted by Brian

Bottom line: Should Apple make this clearer ? Yes, and they probably will, especially after this. Are they violating their own privacy policy, SLA, and TOS? In my opinion, no.

Nor was it ever implied. The criticism lies in the fact that Apple did not address this "specific feature" nor did they explicitely allow the user to opt-out.

[Alexander Turcic]

I am partial to as "how bad" the "spying" behavior in iTunes 6.0.2 really is. According to heise.de, however, Apple is at least violating German privacy laws.