November 22, 2022
Mysk is disputing Apple’s privacy claims, claiming that anonymous usage data for some in-house apps includes a Directory Services Identifier (DSID) that is uniquely linked to Apple ID and iCloud data is being stored by Apple. It does so because Apple collects personally identifiable information despite explicitly promising not to do so.
According to Mysk, Apple could potentially use this DSID to track your App Store browsing habits. This appears to contradict Apple’s claim that none of the data is personally identifying, and appears to apply to iOS 16.
According to Apple’s device analytics privacy policy, “none of the collected information identifies you personally.” But an analysis of the data sent to Apple reveals a permanent, unchangeable ID number called a Directory Services Identifier, or DSID. Mysk’s tests revealed that Apple collects that same ID number along with information for your Apple ID, which means the DSID is directly linked to your full name, phone number, birth date, email address, and more.
The researchers also discovered that iOS 14.6 sends large amounts of first-party app activity to Apple, even if device analytics are turned off or collection is otherwise limited. This includes the model of your iPhone, keyboard languages, and other information that could theoretically be used to fingerprint your device.
Mysk continues by stating that Apple may use Apple ID to correlate analytics data from all of the devices for which you granted consent, but that you cannot be identified.
The sources for this piece include an article in Gizmodo.
