Yes, for example, Angry Birds is doing these things. But it's by your request. The graphic doesn't show the data being "sold" or sent to marketers.
Does WSJ mean location as in your approximate locale (useful to understand where your users are coming from), or actual GPS coordinates?
Their lack of specificity is a bit confusing.
-Network Communications
-System tools (prevent phone from sleeping)
This doesn't include even coarse location, much less a fine GPS position. Unless they're cracking your system, they can't get more than a guessed geolocation of the IP address you're at.
Nor can they access your contacts, read your personal details, steal your emails, read your phones identifier, etc.
Looking at the WSJ story, they don't even include Angry Birds under Android in their analysis. It is, I think, fascinating that there were so many stories on here about Android apps "stealing your data", yet the iPhone market remained opaque, with so many holding some unsupported notion that a high level curation guaranteed good app behavior.
In this case, despite the Android version being only ad supported, I have comfort that it can't possibly be doing what the iPhone app is doing.
Usually country and state fulfills the above purposes just fine. I've seen GPS coordinates sent off the device and then converted to country / state before the coordinates were discarded - that's how Pinch Media used to do it. Flurry typically just works with IP address, but when GPS is used, it does the rounding off on the device first so the only thing we're sent is already inaccurate.
I doubt that it is, I think even the most aggressive and intrusive ad agency would see that the potential bad press that could come from this would outweigh any marketing benefits.
In actual fact, some contact data is sent out only when I use the "share with friends" function (which is never,) as you would expect? Right?
Time for some wireshark action methinks...
Christ, for the startup times I get, this is a decent explanation. =\
Update: other than location when you're not Apple (e.g. iAds doesn't request permission even though it uses your location).
You can opt out of iAds location stuff though, head to: http://oo.apple.com/
And I will say the new location settings in iOS 4 that let you quickly see what is requesting (and recently used) your location are nice.
It's a pretty decent opt-out method, but it only works because something hardcoded in the iOS version of Safari sends the UDID as a X-Header in the HTTP request headers -- specifically to the oo.apple.com domain (and a handful of others, all owned by Apple.)
If any other company wants to offer a systemwide opt-out for its iOS software, it's a lot more difficult.
This Activities API is also what allows developers to so easily roundtrip to a third party app and back again from within their own app. The barcode scanner is a good example.
EDIT: another example is how Launcher Pro lets you make homescreen shortcuts that "deep link" to functionality that is sometimes several menu-levels down inside an application.
However, if the app doesn't have "Read Contacts" permission then there is no way for the app to access your contacts db, and so reason to worry about it sending your contacts db to someone.
Or course, most apps do request "Internet" permission, so I suppose those apps could be scraping up some info they do have info to and sending that out to a 3rd party. :-(
Also why would you ever criticize recreational protocol analysis? Especially on here.
Transmitting location, gender and all the other data specifically to advertisers is NOT part of normal functionality.