Apple, along with Pandora Media and The Weather Channel, have been named in a lawsuit alleging that the companies did not disclose the fact that personal data–specifically location–was being shared with third-party advertising networks.
The suit, filed yesterday in the U.S. District Court in Puerto Rico by Lymaris Rivera Diaz and picked up by The Loop, closely resembles an existing suit from December. That one targeted the same companies as well as other app makers for being able to trace an iPhone or iPad using the unique device identifier, or UDID, which is akin to a serial number in that it cannot be changed.
“Because the UDID is unique to each iPhone and iPad, it is an attractive feature for third-party advertisers looking for a means of reliably tracking a mobile device users’ online activities,” the new suit says. “Because the UDID is not alterable or deletable by a iPhone or iPad user, some have referred to the UDID as a ‘supercookie.’ This description aptly summarizes the desirability of access to the UDID from an advertising perspective.”
The suit takes aim specifically at Apple–as the maker of the device and the mechanism for running and installing applications–for not letting users control access to this piece of user information.
“Unfortunately, however, unlike with browser cookies, Apple does not provide users any way to delete or restrict access to their devices’ UDIDs. Traditional efforts to prevent Internet tracking, such as deleting cookies, have no effect on Apps’ access to an iPhone’s or iPad’s UDID,” it says.
Along with basic user information, the suit also highlights location, specifically the database stored on the device that became a target of interest last month. Apple says this information is used as part of a crowd-sourced database of cell towers and Wi-Fi access points, which lets iOS devices determine their location in a more efficient manner.
Diaz’s complaint focuses on the fact that the location data is stored across backups and between device migrations in an unencrypted format. Apple has since addressed several of those claims as part of a software update that went out to users a week ago and before the suit was filed. Apple has also said that it intends to fully encrypt that database on the device itself in the next major system software update.
The lawsuit seeks class action, and names 10 yet-unnamed defendants the suit says will be “specifically identified and named as discovery progresses and their roles in the wrongdoing at issue is revealed.” It also seeks damages, restitution, and an injunction against Apple for collecting any data attached to UDIDs.