Apple Privacy Nutrition Labels
IDAC Policy Brief
By Gauri Gupta
Summary
Nearly six months after its high profile rollout of app privacy labels, Apple finds itself facing roiling concern about the accuracy and user benefit of the so-called “nutrition labels” for apps. As the news media and Congress look for answers to appropriately pointed questions, Apple has an opportunity to take clear actions to live up to the promise of this strong consumer-facing idea.
The concept of distilling complex app privacy policies into a visual and easily digestible format is certainly a consumer-friendly approach that, if done properly, can improve user awareness and stifle any developer who might profit from inappropriate uses of consumer data. To meet that promise, however, Apple must make adjustments to its current procedures.
Background
In December 2020, Apple launched App Privacy labels, requiring apps to display information intended to help users understand what data is collected from apps and how it is used. These labels are mandatory for any new or updated iOS 14 app in the App Store as of December 8, 2020. These nutrition labels are displayed on each app’s product page in a box that summarizes the app’s data collection and use practices.
These labels fall into four categories: Data Used to Track You, Data Linked to You, Data Not Linked to You, and Data Not Collected. Some of the data collected that a label might reveal includes location data, financial details, and contact information, which it links to an in-service account or identifiers like your device’s ID number. The label might also show that the app goes a step farther and shares that information with other companies to track users across websites and services. Apps that do not collect any data receive a blue checkmark.
To create the labels, developers are required to fill out an online form that has approximately 34 different sections covering typical handling of user data. Some of these are very specific, such as those concerning health details, while others are broader, such as whether the app tracks the taps or clicks a user makes.
Privacy Benefits of App Nutrition Labels
Apple’s nutrition labels have a clear benefit to users, who should be armed with information about how their data is being shared with app developers and what is being done with their data after it is captured. In theory, this empowers users to protect their information from external parties such as marketing or analytics companies.
The label also provides developers with a clear and transparent framework to communicate data collection practises to users. In moving the responsibility for ensuring privacy to the developer, Apple is essentially rewarding app developers who comply by the rules and earn consumers’ trust. Additionally, the policy has the potential to reduce the likelihood of companies selling users’ data and to foster a developer culture that doesn’t allow predatory apps to collect personal information without clear disclosure.
Concerns: WaPo Study and Congressional Letter to Apple
So far, it seems that Apple hasn’t hit the mark.
On February 9, the Chairman of the U.S. House Committee on Energy and Commerce sent a letter to Apple, urging further review and improvement of the labels, and asking for further clarification on how Apple audits privacy information that is provided by app developers. Congressman Frank Pallone Jr. (D-NJ) also asked Apple for details surrounding its enforcement policies when an app fails to provide accurate privacy information. Pallone expressed concerns raised by an investigation published days before by The Washington Post which found apps to be collecting information in excess of what they claimed in their nutrition labels. The Post report found that one third of evaluated apps with “Data Not Collected” labels were, in fact, collecting data.
In one case, a travel app with a ‘Data Not Collected’ label was found sending identifiers and other data to a search engine and social media company, an app-analytics company, and a Russian Internet company. In another case, a slime simulator app that had a ‘Data Not
Collected’ label was found to have shared identifying information with major tech companies and data about the phone’s battery level, storage, general location, and volume level with a video game software development company.
In addition to their request for improvements, the Chairs of the Committee specifically requested written responses to a series of questions, including:
- Details on the process by which Apple audits the privacy information provided by app developers and how frequently audits are conducted;
- How many of the apps audited since the implementation of the App Privacy label were found to have provided inaccurate or misleading information;
- Whether Apple ensures that App Privacy labels are corrected upon the discovery of inaccuracies or misleading information; and
- Details regarding Apple’s enforcement policies when an app fails to provide accurate privacy information for the App Privacy label.
Apple’s Response
In response to reports that nutrition label information is inaccurate, Apple has said that “apps that fail to disclose privacy information accurately may have future app updates rejected, or in some cases, be removed from the App Store entirely if they don’t come into compliance.”
It is notable that these rules technically apply to new apps and app updates. However, some apps have remained on the App Store without privacy labels and many apps are not set to suggest regular updates. While it may simply be a matter of time before the practice is implemented across the App Store, there must be a system in place to ensure that all existing apps comply with these new rules. Additionally, while Apple claims to conduct routine audits and work with developers to correct false or misleading information, the sheer number of apps on the App Store make it infeasible for Apple to routinely monitor each app.
Recommendations
While the new Apple “privacy nutrition labels” should be a privacy-enhancing game-changer for consumers in the mobile app marketplace, the reality depends on what Apple is prepared to do to implement it properly. The real impact will depend on a number of factors, including: (1) whether the labels are easy to understand; (2) how consistently they present information across different products/apps; (3) whether the apps are presented in an accessible manner (users should not have to scroll far down to find label information); (4) the extent to which apps “market” privacy and try to compete on privacy policies; and most importantly, (5) whether the information listed is accurate.
In order for nutrition labels to be effective in practice, Apple should prioritize:
- Ensuring users know about the new rules;
- Ensuring the labels are easy to find and easy to understand; and,
- Ensuring the labels are accurate by an extensive auditing process to verify consistency.
Other, more substantive ideas Apple should consider include:
- Pulling apps from the App Store if there is a credible report that the nutrition label is inaccurate or needs updating;
- Creating a three-strikes and you’re out process for apps which continually report erroneous information on the nutrition label; and,
- Engaging with an independent third party to perform spot checks on the most popular apps and regularly report on the success of the nutrition labels.
- Incorporating certifications provided by third-party reviewers into its App Review process
- Encouraging apps to participate in enforceable codes of conduct to certify their compliance with privacy guidelines
Apple’s Opportunity
Apple has an opportunity to forever alter the digital ecosystem and help rebuild consumer trust in the apps they use. While Apple’s move to make these labels mandatory is a strong first step, it diminishes the value if developers exploit the honor system and do not self-report their practices accurately.
The app nutrition labels will only work if they are accurate and well-utilized. Apple has an opportunity that shouldn’t be squandered.