Despite explicitly promising not to, Apple was found to be collecting personally identifiable information in a recent test of how it collects usage data from iPhones.
None of the collected data “identifies you personally”. However, a review of the information provided to Apple reveals that it also contains a Directory Services Identifier, or DSID, which is an unchanging, persistent ID number.
Your full name, phone number, date of birth, email address and other details are all directly connected to your DSID because Apple gathers that same ID number along with your Apple ID data.
Personal information is not logged, protected by measures such as differential privacy, or excluded from reporting before being forwarded to Apple. But Apple receives the DSID, which is directly linked to your name, in the same package as the rest of the analytics data.
“Having a DSID is like having a name. Identity is one-to-one,” said Tommy Mysk, a security researcher and application developer who collaborated with Talal Haj Bakry on the tests. “These comprehensive reviews are all directly related to you. It is a problem that cannot be turned off.”
The findings complicate previous findings about Apple’s privacy concerns and assurances. Mysk discovered earlier this month that even if you disable an iPhone feature labeled “Share iPhone Analytics”, Apple is still collecting analytics data. A class-action lawsuit was filed against Apple for allegedly misleading customers about the Mysk test a few days after Gizmodo published it.
Theoretically, Apple can argue that your ID number is not personal information. The massive European data protection law known as the GDPR, which has set global standards for data regulation, defines personal data as any information that “directly or indirectly” identifies a specific person, including identification numbers.
Mysk responded, “I think people should be outraged by this. This is not Google, because they think this will never happen, people prefer iPhones. Apple has no right to observe it.