4 ms·
Pandora, Angry Birds, other apps selling private info to advertisers
- Terretta 16y agoMost of these are not "selling", they're providing normal 'connected' functionality. For example, any app that uses a name and password to access a server, they say is transmitting a password. Any app that you invoke "invite my friends", they say is transmitting your contacts. Yes, for example, Angry Birds is doing these things. But it's by your request. The graphic doesn't show the data being "sold" or sent to marketers.
- brown9-2 16y agoAny idea why Angry Birds would be collecting your Location and giving it to Google and Flurry Analytics, according to this infographic? Does WSJ mean location as in your approximate locale (useful to understand where your users are coming from), or actual GPS coordinates? Their lack of specificity is a bit confusing.
- gommm 16y agoIt seems that for example for Angry bird they send the Latitude/Longitude http://blogs.wsj.com/wtk-mobile/2010/12/17/angry-birds/ http://blogs.wsj.com/wtk-mobile/2010/12/17/angry-birds/
- ergo98 16y agoAngry Birds only requests the following two permissions on Android- -Network Communications -System tools (prevent phone from sleeping) This doesn't include even coarse location, much less a fine GPS position. Unless they're cracking your system, they can't get more than a guessed geolocation of the IP address you're at. Nor can they access your contacts, read your personal details, steal your emails, read your phones identifier, etc. Looking at the WSJ story, they don't even include Angry Birds under Android in their analysis. It is, I think, fascinating that there were so many stories on here about Android apps "stealing your data", yet the iPhone market remained opaque, with so many holding some unsupported notion that a high level curation guaranteed good app behavior. In this case, despite the Android version being only ad supported, I have comfort that it can't possibly be doing what the iPhone app is doing.
- gyardley 16y agoPeople collect location for a lot of reasons - localizing content, planning local advertising purchases, selling in-app advertising to agencies who want to buy access to a particular audience, etc. Sometimes developers just want to understand where their users are coming from out of curiosity. Usually country and state fulfills the above purposes just fine. I've seen GPS coordinates sent off the device and then converted to country / state before the coordinates were discarded - that's how Pinch Media used to do it. Flurry typically just works with IP address, but when GPS is used, it does the rounding off on the device first so the only thing we're sent is already inaccurate.
- ddlatham 16y agoFlurry Analytics will show you how many users and sessions you have in each city / state / country.
- JonnieCache 16y agoI hope that this is in fact the case, and that the android angry birds isnt just gzipping my contacts db and pushing the whole lot out to an ad agency every time I load the program. I doubt that it is, I think even the most aggressive and intrusive ad agency would see that the potential bad press that could come from this would outweigh any marketing benefits. In actual fact, some contact data is sent out only when I use the "share with friends" function (which is never,) as you would expect? Right? Time for some wireshark action methinks...
- leif 16y ago> I hope that this is in fact the case, and that the android angry birds isnt just gzipping my contacts db and pushing the whole lot out to an ad agency every time I load the program. Christ, for the startup times I get, this is a decent explanation. =\
- mike-cardwell 16y agoIf I went to install Angry Birds on my Android phone and Android stated that it required access to my contacts lists, I would abort the install... Do you get any information like that when installing apps on the iPhone or do you have to trust that Apple makes a good decision for you? I'm not sure how the iPhone permissions stuff works, or if that level of granularity exists at all...?
- jonknee 16y agoThere is no notification of requested or used permissions in iOS. Android is definitely ahead of iOS in that department. Update: other than location when you're not Apple (e.g. iAds doesn't request permission even though it uses your location).
- InnocentB 16y agoI get requests when an application wants to make use of my location in iOS. Android has permissions requests beyond this, but I'm fairly confident iOS has at least the one.
- dshankar 16y agoYou're correct. UDID, for example, is part of that "normal connected functionality." Transmitting location, gender and all the other data specifically to advertisers is NOT part of normal functionality.
- maukdaddy 16y agosigh Source link without the lifehacker bullshit: http://online.wsj.com/article/SB10001424052748704694004576020083703574602.html?mod=WSJ_Tech_LEADTop http://online.wsj.com/article/SB1000142405274870469400457602... edit: Direct link to awesome visualization tool : http://blogs.wsj.com/wtk-mobile/ http://blogs.wsj.com/wtk-mobile/
- CodeMage 16y agoWorse, even the WSJ article has the whiff of sensationalism. For example, this is what you find very near the top of the article: These phones don't keep secrets. They are sharing this personal data widely and regularly, a Wall Street Journal investigation has found. An examination of 101 popular smartphone "apps" -- games and other software applications for iPhone and Android phones -- showed that 56 transmitted the phone's unique device ID to other companies without users' awareness or consent. Later on, the UDID is called "supercookie" and the article emphasizes the fact that it "can never be changed or turned off". That would be truly scary if they showed some proof that the user, as a person, could be easily identified by their phone's UDID. Okay, the carrier has that information, but who else has it? Somehow I don't think that the relationship between your phone's UDID and your identity is something easily available to just about anyone.
- davidu 16y agoAre you kidding? The UDID and the phone owner's name are easily correlated. As soon as you register for an account on a game or app, you will connect UDID to your email or first/last name. As soon as that happens, it could easily end up in Rapleaf or another system for other data brokers to get access to. The connection just has to happen once, in one app, for all of them to benefit from it. On the plus side, an app getting this data could auto-register you since it knows you based on your UDID as soon as you install the app, just sending you an email confirmation and a password. :-)
- gyardley 16y agoIn order to get any online data broker interested in your data, you have to tie it to their browser cookie. On iOS, this is hard, thanks to sandboxing. You pretty much have to redirect the user to the Safari browser with the UDID in the query string - which is a pretty crap experience for the user, which is why it's rarely done. Even then you've only gotten the data into the mobile browser, which is not what the data market wants to pay for right now. People still predominantly buy things through their desktop computers. I don't know if it's vanity or narcissism or what, but everyone assumes their 'data' has a lot of commercial value. It doesn't. Back when I was running an iPhone analytics startup, I looked into all of this stuff. Wasn't even worth the development work to monetize it.
- jamesaguilar 16y agoI don't think anyone should be surprised that indeed, phone apps, like all other apps, send data to analytics providers.
- tdfx 16y agoWell... you don't sell many papers when you put it THAT way.
- anto1ne 16y agojailbroken users can install a opt-out pref : http://blog.iphone-dev.org/post/164789333/a-pinch-too-much http://blog.iphone-dev.org/post/164789333/a-pinch-too-much
- scotus69 16y agoif you are jailbroken install PrivaCy from within Cydia: http://cydia.saurik.com/info/com.saurik.privacy/ http://cydia.saurik.com/info/com.saurik.privacy/
- aerique 16y agoAlso don't forget Firewall iP off Cydia. You get notifications and can set permissions per app. Ah, I would never use a jailed iPhone. So much less usable.
- fredoliveira 16y agoI am very concerned about this particular comment: "I am a consultant for a software company that does iOS apps. It is scary how much information Apple gives us about the customer. We know everything the customer has (ever) done on their device. This includes their browsing history." Can anyone verify this? If so, this is crazy.
- calloc 16y agoReddit.com Reddit.com Reddit.com Reddit.com Reddit.com news.ycombinator.com news.ycombinator.com Reddit.com Honestly, I am not too worried about my browsing history on my phone ;-)
- dustingetz 16y agoWikileaks.org ... whoops!
- gyardley 16y agoIf it is true, I don't know how to do it, and I'm a product guy at an iPhone analytics company. The browser's pretty effectively sandboxed from the application, which is why everybody has to use the UDID to begin with instead of the typical user-id-in-a-cookie scheme used everywhere else.
- naz 16y agoFalse. Unless the device is jailbroken. Each app has a separate cookie store and web cache. However, you can access the address book without prompting.
- uxp 16y agoHow does jailbreaking enable normal iOS store apps to access other apps sandboxed datastore? Or do you mean that only Cydia apps can access other apps datastores?
- jlgosse 16y agoFirst off, when you install an application on Android it tells you every permission that an app asks for, i.e.: Location Data Contacts Etc As a developer of mobile apps and a user of both flurry and AdMob, I send them a both user's "data" in order to find out the general location of the user, as well as the OS they are running and the device they own. This isn't "selling" their data, it's giving it to these analytics platforms so we can view our audience and therefore allow us to better serve our users/customers. The same hoopla can be brought up about Google Analytics and AdWords. This isn't a new phenomenon, and it isn't a big deal.
- jonknee 16y agoGPS location and device UUID is a lot different than IP geo-location and cookie that Google Analytics uses. It's also not possible to block--I block Google Analytics and sometimes use proxies, but can't tell Angry Birds to not send out my info.
- Que 16y agoYou are correct, it is different. IP Geo-Location is a hack for when GPS Location and uniqueID aren't available, so the prudent choice to gain accurate analytic info would be to use the most accurate. Especially if you are a developer / publisher trying to tailor your functionality to your particular audience. Android does inform you, in advance of installation of exactly what information the application would like access to so you can be absolutely aware of what information you are freely giving up when installing an application. Your only means to block access however after installation is if you have root access and modify host entries.
- mikeryan 16y agoI believe Apple's TOS doesn't allow you to use location data if you're only using it for advertising purposes. This of course wouldn't preclude admob from doing IP Geolocation but I really have no idea how accurate this is on mobile devices.
- uxp 16y ago
- nowarninglabel 16y agoI guess Lifehacker (gawker) is content to give user's personal info away for free.
- Aaronontheweb 16y agoHonestly, I'm not surprised - the most valuable thing most of these applications do is produce lucrative information that big budget marketers would love to sink their meathooks into. There is nothing wrong with this business model per say, but doing it without the express consent with your users is wrong and making it personally identifiable is wrong.
- RK 16y agoAnyone who provides data to mylife.com (Pandora on Android) is evil in my book.
- jdp23 16y agoWith the Commerce Department and FTC reports both calling for better consumer protection, articles like this highlight how badly the current self-regulatory approach isn't working.
- JoelPM 16y agoAngry Birds Privacy policy: http://www.rovio.com/index.php?page=angry-birds---frequently-asked-questions-faq#privacy http://www.rovio.com/index.php?page=angry-birds---frequently... I was pissed until I read the FAQ and discovered when they're using data and what they're using it for. Basically: If you've registered with Crystal Something-or-Other they send your data to them. The WSJ article, at least in the Angry Birds case, seems to have sensationalized things.
- dpcan 16y agoIt isn't "stealing" if the user agrees to the app's User Agreement that probably mentions what's happening with the data that is collected.
- ja27 16y agoAm I the only one wondering how can I hook up with the advertisers paying for this data?
- deleted 16y ago[deleted]
- jrockway 16y agoI have root on my Android phone. How can I give certain apps fake UUID and phone number information?
- Groxx 16y agoApparently, the youtube app sends your username and password to... * gasp * Google! Oh, the horror. Though I'm quite thankful for the breakdown, as a lot of this is probably almost completely unknown to people, some of the inclusions seem rather suspect. I wonder if they included legitimate data transmissions to pad the icon gallery / table.
- brisance 16y agoIn the submitted subject title, the claim is that private info is being sold. However, in the original WSJ article: Free and paid versions of Angry Birds were tested on an iPhone. The apps sent the phone's UDID and location to the Chillingo unit of Electronic Arts Inc., which markets the games. Chillingo says it doesn't use the information for advertising and doesn't share it with outsiders. Chillingo does not deny collecting the info, but they do deny using the information for advertising or sharing it with outsiders.
- bad_user 16y agoOh, the stuff you can do on the iPhone. Just the other day I implemented a hidden webview in an iPhone app. The webview subscribes users to third-party affiliation programs (e.g. Groupon) automatically ... basically the thirdparty service is chosen based on how much money it gives to affiliates / if it's available at the user's location (that's why it needs to be automatic). Behind the scenes a Javascript is loaded in the webview that does plain requests to these services. Because many do not provide an API, I have to fake it ... XmlHttpRequest is not enough because of all the restrictions. So I implemented my own XmlHttpRequest-type functionality by using webview-delegates, but without the restrictions. The logic behind using a WebView is that you can load / update the subscription logic on the server-side, without updating the application in the iTunes Store. Best thing of all, this works even with Apple's earlier restrictions related to dynamic languages. Also, the logic behind doing this client-side is that many services complain when requests come from the same IP. You cannot be caught when moving this client-side. Just to be clear: users are properly informed they are going to get subscribed for spams from their city.
- GrandMasterBirt 16y agoSo they need to create paid versions and you pay for this stuff. A game of the same caliber of angry birds would sell for 20 bucks or so as a computer game. There you go, shell out the money. Oh wait since everyone wants it for free you better be willing to pay something. That something is something people see little value in giving away, but is of high value to advertisers.