Apple Inc. have been quite explicit in their claim that “What happens on your iPhone stays on your iPhone.” so the news that they are looking down barrel of a class-action lawsuit after it was alleged that the company is selling customer data such iTunes purchases as well as their personal data gleaned from its iTunes and Apple Music services, is all the more surprising.
On Friday 24/05/2019 three iTunes customers (as part of a potential class action) from Rhode Island and Michigan sued in federal court in San Francisco seeking to represent hundreds of thousands of residents of their home states who allegedly had their personal listening information disclosed without their consent.
The disclosure of iTunes customers’ personal data isn’t only unlawful but can also be dangerous because it allows for targeting vulnerable members of society, according to the complaint. “For example, any person or entity could rent a list with the names and addresses of all unmarried, college-educated women over the age of 70 with a household income of over $80,000 who purchased country music from Apple via its iTunes Store mobile application,” the customers said. “Such a list is available for sale for approximately $136 per thousand customers listed.” It suggests that adverts are being targeted at specific demographics. For example, high-earning women of child-bearing age that have listened to Barry White in the past month could be shown ads for high-quality nappies.
The complaint goes on to allege that third parties in receipt of the information have themselves passed it on, without any permission from the original user. It even provides examples of marketing companies that have (and used) such info.
It adds that in addition to offering data to marketers, the same info is also available to developers working on integrations and extensions for the service, effectively handing them the data on a silver platter.
More worryingly still, the papers allege that Apple was aware that listening data was leaking after a blog post in early 2016 drew conclusions that Apple acknowledged but failed to fix for eight months.
They seek $250 for each Rhode Island iTunes customer whose information was disclosed and $5,000 for each one in Michigan, under the states’ respective privacy laws.
Representatives of Apple didn’t immediately respond to a request for comment on the lawsuit and as the class-action gains members, we’re likely to see more states and more settlement proposals in the coming weeks.
The case is Wheaton v Apple Inc., 19-cv-02883, U.S. District Court, Northern District of California (San Francisco).
