Apple's privacy schtick is just an act, say folks suing the iGiant: iTunes 'purchase histories sold' to data slurpers

Class-action lawsuit accuses Cupertino of breaking the law by flogging personal info

Apple has been hit with a class-action complaint in the US accusing the iGiant of playing fast and loose with the privacy of its customers.

The lawsuit [PDF], filed this month in a northern California federal district court, claims the Cupertino music giant gathers data from iTunes – including people's music purchase history and personal information – and then sells that info to "data aggregators, data appenders, data cooperatives, list brokers, and other third parties."

"To supplement its revenues and enhance the formidability of its brand in the eyes of mobile application developers, Apple sells, rents, transmits, and/or otherwise discloses, to various third parties, information reflecting the music that its customers purchase from the iTunes Store application that comes pre-installed on their iPhones," the filing alleged.

"The data Apple discloses includes the full names and home addresses of its customers, together with the genres and, in some cases, the specific titles of the digitally-recorded music that its customers have purchased via the iTunes Store and then stored in their devices’ Apple Music libraries."

What's more, the lawsuit goes on to claim that the information Apple sells is then combined by data harvesters, marketers, and others with information purchased from other sources to create detailed profiles on individuals that allow for even more targeted advertising.

Here's the key claim:

Apple has sold, rented, transmitted, and/or otherwise disclosed the Personal Listening Information of the Plaintiffs and millions of its other customers to developers of various mobile applications available for download in its App Store, as well as to data aggregators, data appenders, data cooperatives, list brokers, and other third parties, many of whom have in turn re-disclosed Plaintiffs’ and the other unnamed class members’ Personal Listening Information to other third parties for further exploitation and monetization – all without providing prior notice to or obtaining the requisite consent from anyone. Such disclosures invaded Plaintiffs’ and the unnamed Class members’ privacy and have resulted in a barrage of unwanted junk mail to their home addresses and e-mail inboxes.

Additionally, the lawsuit alleges the Music APIs Apple includes in its developer kit can allow third-party devs to harvest similarly detailed logs of user activity for their own use, further violating the privacy of iTunes customers.

Apple Safari icon

One step forward and one step back for Apple's privacy campaign with latest Safari build


The end result, the complaint states, is that Cook and Co are complicit in the illegal harvesting and reselling of personal data, all while pitching iOS and iTunes as bastions of personal privacy and data security.

"Apple’s disclosures of the personal listening information of plaintiffs and the other unnamed Class members were not only unlawful, they were also dangerous because such disclosures allow for the targeting of particularly vulnerable members of society," the complaint reads.

"For example, any person or entity could rent a list with the names and addresses of all unmarried, college-educated women over the age of 70 with a household income of over $80,000 who purchased country music from Apple via its iTunes Store mobile application. Such a list is available for sale for approximately $136 per thousand customers listed."

Apple did not respond to a request for comment on the lawsuit. Apple's privacy policy notes the company may use customers' "personal information to help us create, develop, operate, deliver, and improve our products, services, content and advertising, and for loss prevention and anti-fraud purposes," though it does not mention the sale of any personal records to data harvesters as alleged.

Nonetheless, named plaintiff Leigh Wheaton, of Rhode Island, is suing Apple for violating Rhode Island's Video, Audio and Publication Rentals Privacy Act, while Michigan residents Jill and Trevor Paul are suing for violations of similar laws in that state.

The class-action suit also looks to collect damages for others covered by those laws, and these sort of suits will often be expanded or merged with other cases to cover a much larger class of customers. The suit seeks a jury trial to decide damages. ®

Similar topics


Send us news

Other stories you might like