Privacy “Fail” for Popular Health Apps

Privacy Rights Clearinghouse’s recent study found that many health and fitness apps are lacking on the privacy front. The report evaluated 43 paid and free apps in the health and fitness categories on Google Play and and Apple’s App Store. The privacy-focused non-profit discovered that many of these apps lacked privacy policies, failed to encrypt data and failed to notify users that data is transmitted to third parties. “given the often sensitive nature of health data stored on wellness apps, which can range from weight loss trackers to blood glucose monitors, apps used for health purposes should be adhering to a much higher standard of privacy and security protection,” said Beth Givens, founder and director of PRC. 

According to the report:

  • 13 percent of free apps and 10 percent of paid apps encrypt all data connections and transmissions between the app and the developer’s website.
  • 39 percent free apps and 30 percent of paid apps send data to someone not referenced by the developer in the app or privacy policy.
  • 26 percent of free apps and 40 percent of paid apps did not have a privacy policy.
  • 43 percent of free apps and 25 percent of paid apps provided a link from the app to a privacy policy on the developer’s site.

Perhaps if these developers had used PRC’s best practices for mobile apps,  these apps would have received a better grade!


Comments { 1 }

App Quality Alliance’s Privacy Guidelines

The App Quality Alliance (AQuA) has updated their mobile application development Best Practice Guidelines to incorporate consumer privacy-focused recommendations. The update is designed to help mobile developers address topics such as “users’ rights, location data, and information security and accountability.”

Working directly with the GSM association (GSMA), the guidelines take on a privacy-by-design approach: “The Best Practices are what you can use when you’re designing your application, and trying to work out how you should some of these aspects so you can avoid any errors in the early design stage.”

Comments { 0 }

Apple Announces No More UDIDs

Apple stated on its developer blog that starting May 1st, ”the App Store will no longer accept new apps or app updates that access UDIDs. Please update your apps and servers to associate users with the Vendor or Advertising identifiers introduced in iOS 6.”

In August 2011, Apple announced that it would phase out third party use of UDIDs – third party app developers were instructed to stop tracking iPhone, iPod Touch, and iPad users by the unique identifier number attributed to each of its devices and instead, create their own unique identifiers. Apple provided the Advertising Identifier, an alternative to the UDID, when it released iOS 6 last September. The recent Apple iOS 6.1 update included the option to reset this “non-permanent, non-personal, device identifier” feature, that is located below the Limit Ad Tracking feature.

As Gigaom notes, by May 1st the Advertising Identifier will have been available for eight months, “plenty of time for those who want to understand how their apps are being used to switch over to the new system.”

Comments { 0 }

Star Trek App Uses Sensory Data

Named after the upcoming Star Trek film by director J.J. Abrams, “Star Trek Into Darkness,” is one of the first apps available in the US to utilize Gimbal‘s new ”context awareness platform.” Developed by Qualcomm labs, Gimbal, “expands the ecosystem of offerings that are turning the smartphone into the new digital ‘sixth sense,’ opening up new ways for app developers, service providers, brands, agencies and other industries to offer contextualized utility and new user experiences.” The Star Trek app is a great example of how apps are now starting to use a wider range of sensors.

Furthermore, Gimbal keeps privacy in mind by making its platform opt-in, as well as requiring that the user, ”explicitly allow applications to access the data collected by Gimbal, all of which is stored directly on your device, rather than in the cloud.” That way, users won’t scream “KHAAAN” when the app uses your data! 



Comments { 0 }

Mobile Advertising, Tracking and Consumer Control

Last year, the Wall Street Journal published a story as part of the “What They Know” series that focused on the use of device identifiers by mobile analytic companies and ad networks. The companies were using this identifier on the iOS and Android platforms in order to recognize unique users, enabling site analytics reporting, ad reporting and behavioral advertising. On the web, companies rely on cookies for this type of user tracking. Although in-app browsers can still leverage cookies,  developers typically transmit device identifiers to analytics companies or ad networks in place of cookies. The story resulted a good deal of controversy, since consumers were surprised to learn that companies were using device identifiers as an alternative to cookies.

What’s the difference? The problem was that unlike cookies, which can be deleted, the device identifiers did not come with any user privacy settings. On Android, resetting the device identifier was possible, is but requires wiping clear the entire operating system.  On Apple’s iOS platform, this identifier could not be deleted or cleared at all.

Apple responded when it released iOS6, introducing a new advertising identifier as a replacement for the device identifier.  It also provided a setting for users to “Limit Ad Tracking.”  And now, with the release of iOS 6.1 update this week, Apple has provided consumers with the ability to reset and clear the advertising identifier.

This move comes just in time because pressure on the use of permanent identifiers for ad related tracking has continued to mount.  The recent guide for app developers released by California Attorney General recommends against the use of “persistent globally unique identifiers.” Now that Apple’s advertising identifier can be cleared and reset, this concern has been alleviated.

Companies that are using the Android ID should be sure that they hash or encrypt it so as to not store or log the Android identifier itself.  And on either platform, companies should ensure that they are properly disclosing the use of identifiers in their privacy policies and should advise users about how to decline targeting practices using device settings or with opt-out options.

For further tips about getting mobile privacy policies right, see our previous post on the topic.


Comments { 0 }

Reset Your Apple “App Cookie”

Apple’s promised ability to reset the advertising  identifier is now available to consumers. Today’s iOS 6.1 update includes an option to reset Apple’s advertising identifier, the “non-permanent, non-personal, device identifier” feature, that is located below the Limit Ad Tracking feature. 

Comments { 0 }

‘Green Button Connect My Data’ PowerTools App

On Data Privacy Day,  San Diego Gas & Electric(SDG&E) and Candi Controls announced that the PowerTools app is available for customers to download on their mobile phone or tablet to check recent energy use, set and manage energy saving goals, and track weather patterns related to energy use. The app utilizes the Green Button Connect My Data and is the first app in the nation to receive certification through the TRUSTed Smart Grid Privacy Program, a self-regulatory program that certifies that companies use responsible privacy practices as they collect and share consumer smart grid data.

“Privacy of customer data is important to SDG&E, and we are committed to protecting our customers’ data as well as equipping customers so that they can make smart choices about how they share and use their energy data,” said SDG&E Vice President, Customer Services, and Chief Customer Privacy Officer Caroline Winn. “The PowerTools app is a user-friendly tool for customers to analyze their energy use. We are pleased that it has received the Privacy Smart Powered by TRUSTe Seal, which offers an added level of assurance for customers interested in authorizing trusted sources to use their energy data.”

For more information, click here!

Comments { 0 }

Key Tips For Publishing Your Mobile App Privacy Policy

There has a great deal of recent attention focused on mobile apps that fail to provide adequate privacy policies. In just the past week, the FTC released its second report on the failure of kids’ apps to provide meaningful disclosures. The California Attorney General has begun enforcing California state law against companies that have not posted mobile app privacy policies. Companies rushing to place links to their desktop policy in their mobile app can end up exacerbating the problem.

For companies that want to avoid common mobile app policy mistakes, we thought it would be useful to provide a few quick tips:

  •  Review the language you have used to describe user tracking. If you have been very specific about the use of cookies and web beacons, you may need to edit this language for mobile, as tracking works differently in the mobile app world. Developers typically transmit device identifiers to analytics companies or ad networks in place of cookies, although in app browsers can still leverage cookies. Since the device identifier is not easily deleted, it is a more sensitive identifier than the cookie and should be specifically disclosed.  In iOS6, Apple has started providing an alternative to the device identifier. If your policy talks about cookies and “other technologies” this language may be adequate, but given the sensitivity of device identifiers, we recommend that its use be specifically disclosed.
  • If your policy discloses relationships with analytics companies or ad networks and explains how users can limit tracking or decline behavioral advertising, it likely points to the Network Advertising Initiative or Ad Choices sites for opt out options. However, these sites do not provide opt out options that are relevant to the device identifiers that are used by mobile apps. Many leading mobile ad networks do provide behavioral advertising opt out options. You should point to their opt out pages, which usually informs users how to access their device identifiers in order to transmit it to the mobile ad networks to decline mobile behavioral advertising. Confused? We’ve created a mobile opt-out resource page that you can link to. At this page, we provide one central locations where users can find links to a range of mobile opt-out options.
  • Include a link to your privacy policy in the app store. The Apple app store now provides a highly visible tab intended to link to your mobile app privacy policy. Many companies have yet to utilize this feature, giving the impression that your app does not have a privacy policy.

Comments { 0 }

Cali AG sues Delta for lack of privacy policy in mobile app

The California Attorney General, Kamela Harris, has filed suit against Delta Airlines, Inc. for failure to comply with the California Online Privacy Protection Act: “California law is clear that mobile apps collecting personal information need privacy policies and that the users of those apps deserve to know what is being done with their personal information.”

Delta was among the 100 companies that the AG  sent letters to in October warning them that they must inform consumers about their policies for handling personal data collected by mobile apps and online services. This is the AG’s first legal action under the law since her promise to crack down on companies that fail to include a privacy policy within their mobile app. If Harris succeeds, then Delta will be forced to post a policy within its app in addition to paying $2500 for each violation demonstrated at trial.


Comments { 0 }

ENISA Report on Behavioral Tracking

The European Network and Information Security Agency released a report titled, “Privacy Considerations of Online Behavioral Tracking.” The report found that web browser-based solutions have yet to be used in mobile platforms. Tracking is often embedded into the applications themselves and “consequently, there is no way a user can express that he does not want to be tracked without uninstalling the applications. Solutions adapted to mobile platforms should be developed.”

The report fails to mention that platform providers are already taking steps to enable users to have more choice. For example, Apple’s new iOS6 includes the Identifier for Advertising functionality – instead of a permanent UDID, an anonymous number is assigned to the device at random. This feature is temporary, collects no personal information and can even be blocked in the user’s settings.

While there is room for improvement with respect to tracking in mobile apps, this agency should have acknowledged the new mechanisms already in place to more accurately reflect the current state of mobile tracking.

Comments { 0 }
Privacy Policy
Do / Tools
Rate and Review Applications