Children's Privacy: CDD files FTC Complaint Against Nickelodeon Spongebob App

In the latest legal development in the increasingly active world of children's privacy law, the Center for Digital Democracy announced that it had filed a complaint with the Federal Trade Commission against the cable network Nickelodeon and software developer PlayFirst over the SpongeBob Diner Dash game for iOS. According to the CDD's release, the description for the game in Apple's iTunes store inaccurately states that the app complies with the Children's Online Privacy Protection Act ("COPPA"):

As the complaint documents, Nickelodeon and PlayFirst engage in deceptive acts by representing in the privacy disclosure on the Apple App Store that the app’s “data collection is in accordance with applicable law, such as COPPA,” when in fact it is not. The SpongeBob Diner Dash game asks children to provide a wide range of personal information, including full name, email address, and other online contact information, without providing notice to parents or obtaining prior parental consent, as required by the Children’s Online Privacy Protection Act. Nor does the app provide an adequate description of the personal information it collects or how it is used.  

The FTC has not yet responded to CDD's request to investigate Nickelodeon and PlayFirst. CDD's complaint may be read here.

In a related matter, the FTC will reportedly release its update to the COPPA rules this week. These rules, which have been the subject of significant public discussion and comment, are the key regulatory requirements for those companies which collect personal information from children under the age of 13.

Mobile App Privacy: A Slowly Expanding Area

The area of consumer privacy is a broad area that has been discussed, analyzed and given guidance by both the Federal Trade Commission and the White House. Mobile application privacy, an important subset of consumer privacy, is an area of privacy that has been receiving significant attention over the past year as the importance of the mobile platform increases.

The push for protection in mobile app privacy most clearly began with a Joint Statement of Principles laid out by the California Attorney General, created in February 2012. The California Joint Principles represent an agreement by several top companies in the mobile industry. The agreement, which includes Apple, Google, Research In Motion, HP, and Microsoft (in addition to Facebook, which signed on in June), states what these companies promise to do in their mobile app store. The agreement reached by the major mobile companies provides that the California Online Privacy Protection Act is applicable to any application that collects personal data from a consumer. Such an app requires a “conspicuously posted” privacy policy. The agreement provides that when an app is submitted to a mobile app store by the developer there should be a hyperlink to the privacy policy or the actual privacy policy for that particular app. The privacy policy, whether a hyperlink or the full text, should be available in the mobile app store prior to download of the app. The major mobile companies must also provide a method for users to report apps that do not have such a policy or whose policy does not comply with applicable law.

In addition to the Joint Principles, the FTC has released a new Report on marketing mobile applications, in September of 2012, that contains suggestions on how to limit privacy concerns in a mobile app.  The FTC suggests that mobile app creators:

Build privacy considerations in from the start.  The FTC calls this “privacy by design.”… Incorporating privacy protections into your practices, limiting the information you collect, securely storing what you hold on to, and safely disposing of what you no longer need.  Apply these principles in selecting the default settings for your app and make the default settings consistent with what people would expect based on the kind of app you’re selling.  For any collection or sharing of information that’s not apparent, get users’ express agreement.  That way your customers aren’t unwittingly disclosing information they didn’t mean to share.
Be transparent about your data practices….Offer choices that are easy to find and easy to use…Honor your privacy promises…The FTC has taken action against dozens of companies that claimed to safeguard the privacy or security of users’ information, but didn’t live up to their promises in the day-to-day operation of their business.  The FTC also has taken action against businesses that made broad statements about their privacy practices, but then failed to disclose the extent to which they collected or shared information with others – like advertisers or other app developers…Protect kids’ privacy…
Collect sensitive information only with consent.  Even when you’re not dealing with kids’ information, it’s important to get users’ affirmative OK before you collect any sensitive data from them, like medical, financial, or precise geolocation information.  It’s a mistake to assume they won’t mind.

Keep user data secure...The wisest policy is to:

•  collect only the data you need;
• secure the data you keep by taking reasonable precautions against well-known security risks;
• limit access to a need-to-know basis; and
• safely dispose of data you no longer need.

As mobile app privacy is a new and growing area, the actual implications on businesses are not yet clear. The California Joint Statements only require that those mobile app store providers will provide a location for the individual app’s privacy policy. This only implicitly requires that mobile app creators should have a privacy policy. The FTC guidelines are less stringent. As stated in its report on consumer privacy, the FTC does not believe that they have the powers, at this time, to broadly regulate the area of privacy. However, the FTC suggestions show what the the Commission might enforce if given the power to do so by Congress.

(Written by Brett Alazraki, Fall 2012 IBLT Entrepreneurship Assistance Fellow)

The Havoc of a Device Identifier – Apple UDIDs

Most users of the iPhone are completely unaware that Apple has assigned their individual devices a Unique Device Identifier (UDID).  While such an identifier contains numerous privacy implications, it was not until recently that the general public became acutely aware of these UDIDs.  In a post on Pastebin, on September 4, 2012, the hacker group AntiSec announced that they had obtained a file containing over twelve million Apple UDIDs from a FBI laptop.  While the FBI quickly denied this, stating that the laptop was not hacked and that the FBI did not hold such a file, this event led to several articles by numerous tech and law blogs diving into the topic of UDIDs and what these identifiers actually means for iPod Touch, iPhone and iPad users. (In addition, it is possible that non-Apple devices also contain a similar identifier to the UDID and the public has not been made aware of this yet.)
   

One such article, featured on The Verge, focused on what one is capable of doing when they obtain a user’s UDID.  It should be noted before delving into the various privacy problems that results from UDIDs existing that Apple has announced that UDIDs will be replaced by “a new set of APIs” in iOS 6 (released on 9/19/2012), the newest operating system for iPhone and the iPad.  However, it is unclear just what sort of information these new APIs will contain.  The writer of The Verge article, Joshua Kopstein, points out that it is unclear what exactly someone could do with a UDID and industry experts disagree as to the extent of harm that can come solely from a UDID: 

In a recent article posted on CNET, Frank Heidt, chief executive of Leviathan Security claimed that with a UDID, a push token, and a device name, an attacker "could arbitrarily load an app on your phone." But Alex Radocea, a senior engineer at CrowdStrike, says that’s not true.

"There’s been a lot of misinformation," Radocea told The Verge over the phone. Just as AntiSec released their list of device IDs, he and his team posted the results of their examination of the iOS version of FinSpy Mobile, a strain of the infamous FinFisher spyware that was recently found targeting political dissidents.

In their report, CrowdStrike points out that the spyware is using ad-hoc distribution, a method usually reserved for testing which uses UDIDs to bypass Apple’s application signing process. But that doesn’t mean that a UDID is the magic bullet for remotely installing malware on a device without the user’s knowledge, Radocea says.

"The main thing is that user interaction is required to install these applications," he clarified. "They cannot be silently or arbitrarily installed, as the CNET article alleges." In a blog post written shortly after news hit of AntiSec’s release, the ACLU similarly suggested that UDIDs could be used to secretly infect devices with the spyware.

Kopstein goes on to further discuss how in the past UDIDs have been used to access the geographic information of an individual user.  In addition, the UDID is solely in the control of Apple, and the only way for an individual to get a new UDID is to get a new iPod Touch, iPhone or iPad. 

What exactly the release of these 12 million UDID truly means is still unclear, but if nothing else, this release has raised public awareness of the issue.  (There is also a large concern over whether or not the FBI actually had these 12 million UDIDs, what the FBI was doing with this data, and if they truly did have the file, why was it being stored on a laptop that was so easily hacked?) And, as discussed earlier, Apple is removing the UDID from the newest version of its operating system.  However, the fact remains that millions of iPod Touches, iPhones and iPads contain a unique identifier over which the user has no control and which can do uncertain things to a user’s personal device

Via The Verge
(Written by Brett Alazraki, Fall 2012 IBLT Entrepreneurship Assistance Fellow)