However, the questionaire seems quite complicated. I ask for the email adress and Apple wants to know if I connect the email address with the identity of a user. However, what does that even mean? I have no identity of a user except the email address.
This is discussed here (search for “identity”): https://developer.apple.com/app-store/app-privacy-details/
In contrast, when you provide Facebook an email address, they will explicitly pay a lot of databases to cross-reference your email address and tell Facebook your identity, your salary, and so on.
Can you elaborate on this?
Multi-billion dollar industry that's focused on collecting data from many different sources, consolidating, and aligning towards real individuals with a combination of deterministic data and probabilistic assumptions.
Then, they can sell access to that database to various companies, mostly in the ad-tech space.
Source: did consulting work for an ad platform in the RTB space on the DSP side, competitor to Google.
EDIT (more context / sidebar thought): this is also why Apple deserves some credit here for their moves, as they are one of the few companies with enough of a war chest to fight against these multi-BILLION dollar interests. It's the type of advantage I worry about losing if Apple has to open up different app stores on the iPhone: if a developer doesn't want to submit documentation and/or get bad publicity for lack of a privacy label, they'll just go to a different, less strict app store.
I'm also aware of Facebook's practices, but your comment seemed to be talking about a specific incident or situation -- that's why I asked.
That is not my interpretation. As I'm reading it, all data that is routinely collected has to be disclosed, even if it is never cross referenced with any third party datasets.
I think if you create a record on your server for each user (identified by some user ID) and you store the user's email address in that record, then you must disclose that fact.
If the same person registers two accounts with two email addresses, but provides the same mailing address for both, and you send a postal catalog to each of them, would your systems detect the duplication and only send one catalog?
If either Yes, and for some companies it's both Yes, then you are linking their email address to their identity — their personhood, their struct {} of data fields.
If either No, and for many companies it's both No, then you are not linking their email address to their identity.
(Obviously having postal address creates other problems for you, I'm just trying to do my best to analogy here. For definite answers you presumably already have contacted Apple, as Apple is clearly reserving the right to make judgement calls when asked questions about this.)
Probably. I find it odd that Apple didn't choose words that are already clear with respect to privacy laws such as GDPR. The GDPR doesn't talk about identity. It defines personal data or personally identifiable information (PII). If you collect this data, you're subject to GDPR compliance.
Apple has a weird phrasing of this. You apparently can collect an email address, but not link it to an identity, which is different from collecting an email address and linking it to an identity. It's unclear to me what they mean by this and what "identity" is supposed to mean.
It's way easier to say: an email address is a piece of data that could identify a person, hence you must treat it carefully and comply with GDPR laws (collect it with consent only, make sure to delete it when you're done, user's right to change PII and user's right to get info about everything they have on you).
The way I'm reading it is that "identity" is anything that uniquely identifies each user of your app, i.e. something like a GUID or any generated user ID. It does not necessarily mean that you are able to identify the real-world person behind the user record.
So for instance, if you collect the number of steps each user has taken each day and you store that information on your server associated with a user ID, then you have collected that data and you have linked it to the user's identity, even if you know absolutely nothing else about that user.
What would it mean to collect data without linking it to a user's identity? I think it means collecting aggregate or statistical data. If you transmit the number of steps taken by each user to your server, but you only ever store the average number of steps taken across all your users, then you have collected data without linking it to a user's identity.
For email addresses the distinction between collection and linking to users makes no sense. It's always going to be both or neither.
So that's what I believe. What's important though is what Apple actually means. And I fully agree with you that this document needs clarification.
Therefore if you collect email addresses for user account purposes you would probably answer yes to to the first question about whether they are linked to the user's identity, and then no to the second question of whether you use them for tracking purposes.
In order words :
On side A you have the user's email address OR hashed email address.
On side B, you have other items of identifiable information ("their account", "their device", "other details").
The question is simple. Do you link side A to side B ? Yes or no.
Erm ? Exactly what it says ?
"Their account" is their account on your platform. "Their device" is a device that they own and that you are collecting information about.
As I said, its simple.
Email.
Are you linking it to _ANYTHING_ else ? Yes or no ?
Are you are collecting an email address (or hash of an email), ON ITS OWN and not doing any further processing.... e.g. for a simple mailing list ?
Or are you collecting an email address (or hash of an email) as part of broader set of data you are collecting from the user ? (e.g. email + name + address etc.)
Or are you collecting an email address (or hash of an email) and then sending it off to Facebook or other API in an attempt to build a picture ?
You mean, the Apple account on my platform? How does it get there? I don't have the Apple account of a user. I just have an email address.
> "Their device" is a device that they own and that you are collecting information about.
I don't collect information about their device. But you still didn't answer the question. What is "their device"? Is it a unique device ID? A fingerprint? What is it?
> Are you linking it to _ANYTHING_ else ? Yes or no ?
I use the email to create an account on my backend. Users can backup data to their account. But nothing ties to "identity". They could fake all of it. I don't care. I send transactional emails, such as a reset password email.
> Or are you collecting an email address (or hash of an email) as part of broader set of data you are collecting from the user ?
Not PII data, just stuff they enter in the app.
> Or are you collecting an email address (or hash of an email) and then sending it off to Facebook or other API in an attempt to build a picture ?
No.
But the details of your questions show, imho, that the concept of identity is non-trivial.
I can summarize it very simply: users sign up for an account, identified by an email adress (I don't care if it's real), as a service for the user to have an online backup and an easy way to sync data between devices or move them to Android. The goal is NOT to personally identify a user. But could a user be identified by the email address alone BY SOME ENTITY? Yes, probably. Do I do it? No. Do I share the data or offload it to a third party for data processing? No. Or does my rented self-managed VPS, where the backend runs, count as third party? I don't think so. But of course, I use a transactional email service to send emails to users. What about that? I do have a GDPR-compliant data processing agreement for that. But not sure what Apple wants from me in this case.
Thing is: It's not trivial and Apple's guide is insufficient. That's all I'm saying.
Edit: And to clarify – if it's complicated, data collecting entities such as Facebook could say "well, we did understand this differently" and simply don't tell the truth about the data they're collecting. I guess that is another point in this whole discussion: What if someone lies about their data collection practices? Any consequences? Are there downsides to lying about it?
Then you are collecting emails to identify users. It doesn't matter if the email is fake or not.
In other words, you are explicitly connecting a specific device to a specific account on your backend via that email.
I use it to authenticate users. I don't use it to "identify" users. I give zero fucks about the identity of users.
> In other words, you are explicitly connecting a specific device to a specific account on your backend via that email.
No, because I don't collect any more data about the device, I don't link anything. Users use the app. They can use multiple devices. I know nothing about the devices and don't care. Users themselves link their account to their device (on their device), but I don't get any information about this.
I posted this in another comment, but it makes sense here too:
I find it odd that Apple didn't choose words that are already clear with respect to privacy laws such as GDPR. The GDPR doesn't talk about identity. It defines personal data or personally identifiable information (PII). If you collect this data, you're subject to GDPR compliance.
Apple has a weird phrasing of this. You apparently can collect an email address, but not link it to an identity, which is different from collecting an email address and linking it to an identity. It's unclear to me what they mean by this and what "identity" is supposed to mean.
If you are able to answer "Is email address[or other collected data] ________ associated the user whose database row has primary key _______?" then that is considered being tied to the account, and thus tied to the identity. If you are using email address as a user id, then it is very much tied to the user's account on your service.
For tying to device, this could be based on reading the devices serial number somehow, using the Id for Advertisers, or just generating a unique random identifier at install time, and use that to distinguish records. So if you can answer "What is the race of the user with random install id _______" then for apples purposes you have tied race to device and thus to identity.
Basically unless anonymized nearly all data that you collect will be considered by Apple to be identity tied, unless you don't have user accounts, and don't include some form of device identifier with the data. It is literally impossible to have any form of user account without at least having one thing "tied to user identity". Even if you use "sign in with apple" and do not collect the anonymized email address they provide, you will have at least "user id" (the "sub" token from apple) and probably also "Other User Content".
For example, an otherwise offline game might collect the time taken to beat each level without any device identifying information to allow the developer to understand if levels were harder than expected. In that case you have collection of "Product Interaction" data that is not identity tied.
And yes, part of answering these questions is an honest assessment whether I and Apple agree on what it means to respect a user’s privacy.
Note: “Personal Information” and “Personal Data”, as defined under relevant privacy laws, are considered linked to the user.
https://developer.apple.com/app-store/app-privacy-details/#l...
Anyways, I wasn't intentionally obtuse here, because I mostly think in terms of GDPR compliance, but you're right. I apparently thought of this in a more complicated way than necessary.
If my app asks for more data, which are backed up as a service to the user (no tracking), that is of course connected to the email address of the account. However, there is no effort from my side to find the actual identity of the user.
This whole identity thing is very confusing. Might need to contact Apple developer support.
If the user has state or permissions on your site based on that email address, that email address is part of the user's account on your site.
What a great day for good developers and consumers to have this as backup to helping preserve people's privacy and stop the blatant selling and abuse of private data. Thank you Apple!
Identity basically means anything that allows you to uniquely identify a user, so the e-mail address would apply.
Apple requires apps to have a web site for customer support. Almost every web server logs anonymous data about visited pages. So, almost every apps need to have "Browsing History" checked??
(Documentation lists the following purposes: Third-Party Advertising, Developer’s Advertising or Marketing, Analytics, Product Personalization, App Functionality, Other Purposes)