Researchers find that iPhone apps secretly collect user data through notifications

Several popular iPhone apps, including Facebook, LinkedIn, TikTok, and X, are allegedly bypassing Apple’s privacy rules to gather user data through notifications, according to tests conducted by security researchers at Mysk Inc., an app development company. The researchers claim that these apps collect unnecessary data related to analytics, advertising, and user tracking when notifications are dismissed, potentially violating Apple’s guidelines. While apps typically gather data only when active, closing an app is believed to halt data transmission and prevent its operation. Yet, a potential loophole emerges through notifications. Apple provides specialized software to facilitate app notifications, allowing apps to play sounds or retrieve information even when closed. In certain instances, the iPhone OS permits a temporary wake-up of the app to connect with company servers, deliver notifications, and conduct essential operations. This brief window of activity is where the identified data harvesting, as observed by security experts, takes place. The collected data appears unrelated to the notification processing and is suspected to be used for fingerprinting – a technique that identifies users based on seemingly innocuous device details. Spokespeople for Meta (owner of Facebook) and LinkedIn denied the allegations, stating that the collected data is used solely to ensure notifications function correctly and that they adhere to Apple’s developer guidelines. However, the researchers argue that the widespread nature of this data collection practice across the iPhone ecosystem is surprising. This is not the first time Mysk’s tests have revealed privacy concerns with Apple. In the past, Mysk found issues with iPhone features aimed at protecting user privacy. The new findings raise questions about the effectiveness of Apple’s privacy measures and the potential misuse of collected data for advertising purposes. While there is an upcoming change to Apple’s rules requiring app developers to explain their use of specific software interfaces, it remains unclear how strictly Apple will enforce these regulations. The alleged data collection practices highlight the ongoing challenges in maintaining user privacy in the digital age.