Apple’s App Store Privacy Nutrition Labels Depend on the Honor Policy, and, Surprising No One, Some Developers Are Dishonest

Thursday, 4 March 2021

Speaking of Geoffrey Fowler, he had an interesting premise in a column last month: are the new privacy “nutrition” labels Apple is requiring developers to supply accurate?

I downloaded a de-stressing app called the Satisfying Slime Simulator that gets the App Store’s highest-level label for privacy. It turned out to be the wrong kind of slimy, covertly sending information — including a way to track my iPhone — to Facebook, Google and other companies. Behind the scenes, apps can be data vampires, probing our phones to help target ads or sell information about us to data firms and even governments.

As I write this column, Apple still has an inaccurate label for Satisfying Slime. And it’s not the only deception. When I spot-checked what a couple dozen apps claim about privacy in the App Store, I found more than a dozen that were either misleading or flat-out inaccurate. They included the popular game Match 3D, social network Rumble and even the PBS Kids Video app. (Say it ain’t so, Elmo!) Match and Rumble have now both changed their labels, and PBS changed some of how its app communicates with Google.

The PBS Kids Video app is eyebrow-raising, but it seems to have been a genuine mistake on PBS’s part:

You can spot the squishiness of the labels in a back-and-forth I had with PBS about the app store listing for its popular PBS Kids Video app. We found the app sending my phone’s ID to Google, even though its label said it didn’t collect data that could be linked to me. PBS told me the label reflected an update to the app it eventually published on Jan. 28, in which Google no longer gets sent my ID but still helps PBS measure performance.

Effectively PBS submitted a privacy nutrition label based on changes to their app that weren’t yet — but soon were — live in the App Store. The rest of the inaccurate nutrition labels Fowler found are rather obscure apps.

Fowler concludes that these labels are useless if they’re not guaranteed to be accurate. There ought to be penalties for falsifying information on these labels. But it clearly isn’t practical for Apple to verify every label for every app in the store. I don’t think that’s any different from the mandatory nutrition labels on food products. The FDA doesn’t verify those labels — it’s the threat of penalties and bad publicity that motivate companies to report accurate information on them. I don’t know anyone who thinks mandatory food nutrition labels are useless, even though surely many of them contain incorrect information.

And if Apple’s new privacy labels are useless, why are so many apps making changes to their actual privacy policies? Would PBS have removed the tracking identifier from its PBS Kids app in the first place? I’m guessing not. It’s good to raise awareness that the information on these labels is self-reported by the developers, and that Apple doesn’t (and practically speaking can’t) verify them technically, but I think we’re already seeing clear evidence that they’re motivating developers to remove or reduce privacy-invasive tracking from their apps.

This point from Fowler, however, I agree is a major shortcoming:

Even with its update, the label is still missing an important piece of information: There’s Google inside.

Nowhere on any of Apple’s privacy labels, in fact, do we learn with whom apps are sharing our data. Imagine if nutrition facts labels left off the whole section about ingredients.

Apple’s next crack at these labels should make it mandatory to list exactly which third-parties data is shared with.