Apple doesn't enforce its own Address Book policy
Summary: Developers get free access to your iOS address book because Apple turns a blind eye to it and doesn't enforce its own TOS.
Why?
Because Apple turns a blind eye to the single largest privacy problem facing it today: Address Book uploads.
Fellow ZDNET blogger Charlie Osborne brings word (via Dustin Curtis) that Apple makes a standard practice of approving apps that upload the entire contents of your iOS address book (including names, address, phone numbers, emails -- everything!) to developer's servers.
In fact, Curtis notes that 13 of the 15 iOS developers he informally polled admitted that they copy their user's Address Books and have databases of "millions" of contacts. One company even bragged that it had "Mark Zuckerberg's cell phone number, Larry Ellison's home phone number and Bill Gates' cell phone number."
Set aside, for a moment, Apple's indiscretions.
Some assumptions I make about my private contact data:
- Developers won't sell, share or even view this information
- Developers take great care to protect the privacy of this information
The problems with the above assumptions are twofold:
- Developers are human (and often overworked)
- Developers can be hacked (Zappos, anyone?)
So why do developers risk the massive public backlash that address book uploads -- when discovered -- can (and do) cause?
The most interesting part of Curtis' post was about the risk/reward ratio to developers who engage in the practice:
Any app is an investment, and, like any investment, there are three outcomes -- success, failure, and mediocrity. The only one that matters on a market like the App Store is success, so fledgling app developers do everything they can to increase their chances. Because Apple provides extremely easy access to address book data, the pro -- that is, using the data to improve user experience, increase virality and growth, etc. -- outweighs the con.
But therein lies the rub. "Apple provides extremely easy access to address book data."
This is patently absurd and actually boggles my mind. Apple will refuse an app for any number of insane reasons, let it routinely approves apps that upload your Address Book wholesale? Something's wrong here. Very wrong.
Again, Curtis:
On iOS, every other seemingly private local data source, like location and the camera roll, have strong protections; apps can't even see photos in the Camera Roll unless the user explicitly selects them from the image picker. There is a huge section of the Settings app dedicated to giving people fine control over which apps have access to location information. That Apple provides no protections on the Address Book is, at best, perplexing.
What's more, AB uploads appear to be in direct violation of Apple's own rules for apps.
According to Apple's Developer TOS:
17.1: Apps cannot transmit data about a user without obtaining the user's prior permission and providing the user with access to information about how and where the data will be used
17.2: Apps that require users to share personal information, such as email address and date of birth, in order to function will be rejected
Assuming that you have information about yourself in your Address Book, (Siri, for example, requires you to have a "me" contact to help it interpret commands like "give me directions home"), surreptitious uploads of your AB file would be a direct violation of section 17.1 of Apple's iOS TOS.
And even if you didn't have a "me" contact in your Address Book, contact information would almost certainly qualify as "personal information" and thus be forbidden for developers to upload under section 17.2.
Right?
Apple hasn't replied to a request for comment. I will update this story when it does.
Related Reading:
- Path discovered phoning home with your address book
- Critical Path: Here’s how Path can save itself, if it acts fast
- Path CEO Dave Morin: Mea Culpa
Follow me on Twitter for early access to my posts. Tweet me with the hashtah #ZDNET if you'd like to be considered for inclusion.
Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.
Talkback
RE: Apple doesn't enforce its own Address Book policy
RE: Apple doesn't enforce its own Address Book policy
RE: Apple doesn't enforce its own Address Book policy
Yes, how about a list?!
RE: Apple doesn't enforce its own Address Book policy
RE: Apple doesn't enforce its own Address Book policy
In other words, I'm not worried about that developers will abuse the data, but what if their server gets hacked and someone steals their db of "millions" of contacts. Look at what happened to PSN, Zappos, etc. These kind of breaches seem to happen more and more often these days.
- Jason
RE: Apple doesn't enforce its own Address Book policy
RE: Apple doesn't enforce its own Address Book policy
They shouldn't be collecting this information (often they have no need to collect the information) and they are storing it on their servers, without the users knowledge or permission.
Those servers can get hacked and all that data ends up in the hands of "bad guys". Whether the App Devs are also bad guys is a matter of opinion. But if they had been acting responsibly, there would be limited or no data to get breached, but they act irresponsibly and there is a lot of data hanging around on their servers, which shouldn't be there.
That is not to speak of the app developer or its employees selling access to the database or selling it wholesale to third parties.
RE: Apple doesn't enforce its own Address Book policy
RE: Apple doesn't enforce its own Address Book policy
The wind blows stronger...
...at the top of the mountain.
Yes, you are right
Microsoft knows very well what Apple is facing right now. The good thing is that these negative stories only really seem to hurt the feelings of the Apple fanboi. Apple itself is laughing all the way to the bank. Just like Microsoft was laughing all the way to the bank when you were huffing and puffing at Microsoft when they were at the top of the mountain.
However, we should distinguish between the spotlight and the act. Apple did nasty things before they reached the top and they are doing nasty things now. The only difference is that Apple didn't get as much attention when they did nasty things while they were losers at the bottom of the mountain. No one cared to report on all of Apple's nastiness. Apple's actions haven't changed, the only thing that has changed is that the spotlight has moved from Microsoft to Apple. The actions were always there, just not the spotlight. I'm glad to see that has changed. We all win when this nasty behavior is exposed.
RE: Apple doesn't enforce its own Address Book policy
Well, if you look at it objectively
RE: Apple doesn't enforce its own Address Book policy
Seriously? Or are you trolling?
So you're saying that you have NO problem with any/every iOS app uploading your entire AB to the developer's servers without telling you?
And I guess that you're fine that Apple doesn't enforce it's own privacy rules in this regard?
Wow. Just wow.
- Jason
RE: Apple doesn't enforce its own Address Book policy
Also, there's quite a few people that really have had issues with recent Apple Devices and this is also stirring the pot on other web sites.
RE: Apple doesn't enforce its own Address Book policy
RE: Apple doesn't enforce its own Address Book policy
RE: Apple doesn't enforce its own Address Book policy
It's not just you....Apple is finally showing its true colors! I'd be outraged if my entire AB was uploaded to some 3rd rate developer working out of China or Russia! Luckily I don't have this problem because I run Windows Phone 7.5!
RE: Apple doesn't enforce its own Address Book policy
RE: Apple doesn't enforce its own Address Book policy