Apple sued for promising privacy, failing at it | Hacker News Reader

Apple sued for promising privacy, failing at it

theregister.com

161 pointsmiles49 comments

I wish the stories that appeared on HN about this kind of thing leaned toward the outcomes of the trial rather than the fact that a trial is starting. It feels like clickbait and fuel for conjecture otherwise.

If news reports only covered trials, you'd rarely hear about disputes. Civil and criminal cases rarely reach trial.

An estimated 2% of federal criminal defendants get tried [https://www.pewresearch.org/fact-tank/2019/06/11/only-2-of-f...]

The figure appear to be similar for civil cases [https://judicature.duke.edu/articles/going-going-but-not-qui...]

I think you're missing the point. Whether or not it proceeds to trial, a suit has an outcome.

It has an outcome AFTER its over. his point was... if you didn't report on it till the outcome you'd never hear about it. They're reporting on the allegations and that's a normal part of reporting. you can't only report on the trial outcomes or else it would never be talked about ahead of time.

You can't wait until the outcome is decided to report on something because then you wouldn't report on it until the trial was over and no one would hear about it for years.

This is a general problem with the news. The resolution of events is less likely to get coverage.

People take advantage of this all the time by just stalling investigations or trials to avoid press coverage. The press forgets about it.

It's not that the press forgets. It's that most settlements are done under a non-disclosure agreements, which prevents the press or the public from knowing the details of the outcome. Settlements generally also do not require an admission of guilt, so you have a situation where, with an age or sex discrimination claim that survives dismissal, a company will pay to settle the claim, will not admit guilt, and will make no public commitment to change its behavior.

A settlement is still an outcome worth reporting on. It’s still more information than, “someone filed a complaint.”

It's the opposite. When a complaint is filed and it gets covered in the press, there's usually some effort to explain the allegations and cite the laws that arguably were broken. And there may be evidence cited in the complaint to support the allegations. You can tell a lot about a case and its likelihood of success from the complaint.

That's significantly more information in a complaint than a settlement, which typically happens when both parties tell the judge to dismiss the claim. There's often no public announcement, so at best the press can say we believe there's been a settlement but we do not know what the terms were. There's literally nothing to report other than the case is no longer active.

Settlements are done in part to limit the disclosure of information that might come to light during a public trial. So unless there's a post-settlement leak (legally risky), a public announcement (with details limited by the NDA) by one of the law firms involved, or a public consent decree (when the government is litigating), there's not a lot to be learned other than someone blinked.

So, the original complaint is buried and we lose that initial information when there is a settlement? Ie: what was already published disappears when a settlement is reached?

If yes, then I’m quite amazed that we can disappear public knowledge so thoroughly in this century. If not, we then have the initial information PLUS the information of the outcome. In the case of settlement, it’s still strictly more information. Perhaps not a lot more, but definitely still more.

> The researchers claim Apple engages in invasive data practices similar to those it forbids among third-parties

Is Facebook funding this lawsuit?

I’m all for extending privacy, but there’s a difference between a company I’m a customer of using my data to provide me with services and every random third-party app or website selling my data to who knows who for a buck.

Apple was caught recording analytical data about how you use your phone with a static identifier.

Basically what Google analytics and Facebook analytics do

The difference with the case you're referencing (here's the link[0], since you didn't include it yourself) is that analytics data inside apps like the App Store is different from the prompt about system-level data collection. If you decline the data collection during setup, other apps might still collect it, since that data collection is defined on your account in App Store -> Account Settings -> Personalized Recommendations. Given you can set up the phone without an Apple ID, declining OS-level analytics doesn't automatically disable the tracking for your Apple ID once you sign in.

0: https://9to5mac.com/2023/01/19/class-action-privacy-lawsuit/

Sounds a bit similar to what Google got in trouble for on Android - saying disabling OS level tracking does not mean web apps (IIRC) can not track either. Aka, saying search history is different enough that the control does not affect it

Good I hope they get racked over for this nearly every one of there "privacy" features has a massive, often undisclosed, caveat or is sidestepped by there own software.

You hope they get “racked over” for saying they won’t sell your data, and then not selling your data?

Apple is very clear when data is collected. Are you saying they shouldn’t be allowed to collect data unless they sell it to third parties?

You mean their Terms and Condition, in specifics and in the rare occasion of using the word "personalization" ?

Except most people goes by what they said in the Ads, in their PRs, submarine articles, in their Marketing Speech, and everything else. And Apple collecting "Data", is against the image of what the public believe they ( Apple ) said or led to believe.

Remember, Apple led and fueled the campaign of Data Collection and Tracking equals violation of Privacy in the first place, regardless of whether it was First Party or Third Party. And it was the same even on HN during 2018 - 2021. People who disagree might want to read through all the comments on the subject during that period. I could count single handedly the people who stood up for the difference between First and Third Party "Data Collection".

You are bullied into getting your data collected.

It starts when you buy an iphone - you can't use it without activating it with apple. Then it starts with a screen that tells you apple will use your data, with no choice. You can turn off some things, but what apple decides you can. I would like to firewall my phone, honestly. People need little snitch for their phone (ungimped)

Really, if apple actually let me into my own phone, I would buy all kinds of stuff without limitation.

I remember what matt ridley said in "the rational optimist" - when there is trust, there are no limits to trade.

I was just given three free months of Apple TV, and I thought it cute how I needed to opt-out of data collection.

It might be the best privacy-aware option available, but that does not mean it is especially good. Merely the least bad option.

We have to be a bit careful here.

I can hear it now:

"We're not being anti-competitive. Our users, and US courts are demanding we lock down our users' privacy. We have no choice but to comply. Maybe Google and Facebook can work out some other way to make money?"

"Oh, yeah, I guess you're right? They are pretty big competitors. Pity that. Oh well, what's to be done? We're all obligated to operate within the confines of the current legal environment after all.'

Apple's competitors are capable of competing with them, so long as Apple doesn't preference itself unfairly

Apple entered the smartphone market in 2007. At that time Apple had no way to preference itself unfairly. They went from zero to capturing 75% of smartphone profits in 2021 and dramatically increased the size of the overall market. I think Apple is quite capable of competing without preference. Are they more successful now due to eco-system lock-in? Sure, but to conclude that that is the only reason they have are competitive is just not considering all of the facts.

[0] https://www.counterpointresearch.com/global-handset-market-o...

Apple lock-in may not be the only reason Apple remains so wildly successful.

But, Apple lock-in, and other self-serving restrictions, may be the reason we don’t hear about many potential products that never make it. Anti-competitiveness protects margins in the long term by avoiding pesky upstarts and challengers that might change the playing field.

(Not critiquing any privacy issue with this comment. Just competitive issues from Apples view, and the view of all the non-Apples, in the abstract and the real.)

Material point is that giving Apple an excuse to be even more draconian with their users' privacy will do nothing to help out these increasingly hypothetical "upstarts".

Apple can be draconian with privacy, and still leave a level playing field, iff it applies the same privacy restrictions to itself that it does for third parties.

This is where its dominance may require antitrust action at some level. Or Apple is unlikely to appreciate restricting itself equally to others.

From my comment in a previous thread on the same topic [1]: "This is about a request used to report a click in the app store, which is technically specified in the privacy policy [2] and you can get a CSV of it from Apple in data requests."

The previous thread was more about whether these logs should exist at all, but as far as the lawsuit goes I (not a lawyer) expect it will go nowhere. I'm kind of sympathetic to the idea that companies shouldn't get to advertise their "commitment to privacy" while having terrible privacy practices, but the legal standard for deceptive advertising seems to be higher and that's probably for good reason. Specific regulation of how online privacy tools can be marketed would be another, more interesting conversation.

[1] https://news.ycombinator.com/item?id=33695937

[2] https://www.apple.com/legal/privacy/data/en/app-store/, "We use information about your browsing, purchases, searches, and downloads. These records are stored with IP address, a random unique identifier (where that arises), and Apple ID"

> What's allowed for Cupertino is verboten for everyone else

So they are not just failing at privacy, but actively infringing it?

And they also broke Hanlon's razor.

First few lines of the article: "I said don't share, but you still wrote it down."

Wouldn't she have to prove they sold her information, not just captured it?

I suppose the expectation is an unfortunate personification of the device. "Keep the secret, device." The trouble is, "the device" is Apple.

Apple has never said that using their App Store doesn’t cause data collection from the user. It’s part of the ToS and they tell you they will do it when you sign up. They have said they don’t sell it, which is a whole different type of complaint. This is a frivolous lawsuit with no teeth in US law.

These privacy settings are like the steering wheel on a kid's stroller.

Google's privacy settings are almost literally just that -- with the cheerful bright colors.

Apple is still doing this to date. Lots of connections to xp.apple.com even with analytics turned off.

What is the traffic to xp.Apple.com? How much of that traffic is sensitive information? What breaks when you block the domain?

According to [1] the domain supports proxies so it might be somewhat trivial to answer rather than just blanketing with, “my data is being sent to Apple.” Let’s get really specific and figure out what is being sent despite settings that explicitly apply to those values.

[1] https://support.apple.com/en-hk/HT210060

> Let’s get really specific and figure out what is being sent despite settings that explicitly apply to those values.

The opening of the connection itself leaks too much information so it's not even relevant what's being sent just that it was opened in the first place.

If you are concerned about any connection at all being made, you shouldn’t be using a consumer OS. You should install something like qubes OS and heavily lock down everything.

It’s unreasonable to expect consumer products to function for highly specialised requirements that are counter to good experience for their intended markets.

Not wanting your computer to spy on you is not a highly specialized requirement.

Apple even uses privacy as a marketing differentiator.

Fetching a list of revoked certificates for example is not spying. If the simple request for this kind of data is a concern, you have very unusual requirements.

You can install proxyman on your device and observe for yourself how much apps and phone track info and talk back to their servers.

why the f*ck is there any netwrork traffic in the first place ?

Plenty of reasons. Fetching the updated list of malware domains is one, fetching the list of revoked certificates, checking for available updates. Checking the list of toggled feature flags, some features roll out in an OS update before being turned on. The addition of AirTags worked like this so it just worked day one when the product was available to buy.

This is all stuff the average user wants and benefits from.

No way to turn it off either. Nobody who sells me a product needs to tell me whats good for me

>Nobody who sells me a product needs to tell me whats good for me

That's exactly what buying a product is. You are letting the seller make the decisions for you, the alternative is building it yourself where you have the full freedom to do anything.

Your job as a consumer is to decide what sellers you think are aligned with your needs or when to build yourself.

Glad to see another informed consumer who buys eggs and only uses them for recipes provided by the grocery store!

What I can’t figure out is why computers include input devices when you aren’t supposed to be making any decisions about how they’re used.

Are the arguments made by this account always stupid AF? Based on the history, I’d say “yes”

I mean some consumers have decided Apple is not selling what it promised and are taking a legal route. Good for them. Just because you have a reason for violating a promise doesn’t make it ok. Maybe make that clear in the first place instead of burying it in a TOS.

There is a perfect solution available. Don't buy the product. No need to get angry about it. It just isn't for you.

So no...

"refrigerate after opening"

"don't eat grapefruit when taking this medication"

"please use seatbelts"

"keep your passwords safe" or "use password managers"

There is a joke, well semi-joke, in product liability circles that every warning label you see on a ladder is because someone won a $10 million lawsuit because people fell down using a ladder.

Things break. Nothing is perfect.

(edited to add the ladder example)

Are you a microsoft salesman from the 90s?

Little snitch ftw

Reply on news.ycombinator.com