A new report claims that Apple collects personally identifiable data from iPhone users even when they explicitly ask the company not to.
The report, from software company Mysk, claims that data sent to Apple has a permanent and unchangeable ID number called a Directory Services Identifier (DSID), which goes against Apple’s own privacy policy. According to their policy for Apple devices, “none of the collected information identifies you personally.”
Mysk says this isn’t true.
“Apple uses DSID to uniquely identify Apple ID accounts. DSID is associated with your name, email, and any data in your iCloud account,” it said in a tweet thread reporting their findings.
According to Apple’s analytics policy, personal data is either not logged, subject to heavy privacy-preserving techniques, or removed from reports altogether. But the Mysk report shows that user DSID is logged in the same packets as all other analytic information, meaning a user’s personal, unique ID is getting sent out every time.
The findings come in the same month that Mysk also discovered that Apple collects analytic data from iPhones even when the “Share iPhone Analytics” setting is turned off. Apple says the feature would “disable the sharing of Device Analytics altogether,” but Mysk said the company obtains analytics from users who have sharing turned off anyway.
While Apple may make the case that DSID isn’t personal information, the European General Data Protection Regulation privacy law, which set standards for data regulation globally, says personal data is anything that directly or indirectly identifies a person, including ID numbers.
Apple did not respond to a request for comment. Apple has already been sued for deceiving users about collecting their analytics. The company hasn’t said anything publicly about the lawsuit or its privacy policy.
