"Congress Queries Apple, iPhone App Developers About Privacy"

The House Energy and Commerce Committee sent letters today to 34 iPhone app developers — including Apple, Path, Twitter, Facebook, LinkedIn, Foursquare and Instagram — asking how their social apps collect user information. The letters can be found here.

It’s all part of an investigation into iPhone privacy that was initiated after Path, a social networking app, was caught by blogger Arun Thampi collecting address book data without permission. Henry Waxman (D-California) and G.K. Butterfield (D-North Carolina) Waxman

and Butterfield asked Apple CEO Tim Cook in February to provide answer questions about whether “Apple’s iOS developer policies and practices may fall short when it comes to protecting the information of iPhone users and their contacts.”

Apple responded March 2, and the House immediately said it still had more questions and asked for a meeting with the company.

This is what the committee had to say today:

Following recent reports that apps could collect address book information and photos without notice and consent from users of Apple’s mobile devices, the members are seeking to better understand what, if any, information these particular apps gather, what they do with it, and what notice they provide to app users. The members want the information to begin building a fact-based understanding of the privacy and security practices in the app marketplace. The apps were selected for the inquiry based on their inclusion in the “Social Networking” subcategory within the “iPhone Essentials” area of Apple’s App Store.

Apple is being asked about its “Find My Friends” app. All 34 have until April 12 to respond. Here are the committee’s questions.

(1) Through the end of February 20 12, how many times was your iOS app downloaded from Apple‘s App Store?

(2) Did you have a privacy policy in place for your iOS app at the end of February 2012? lf so, please tell us when your iOS app was first made available in Apple‘s App Store and when you first had a privacy policy in place. In addition, please describe how that policy is made available to your app users and please provide a copy of the most recent policy.

(3) Has your iOS app at any time transmitted information from or about a user’s address book? If so, which fields? Also, please describe all measures taken to protect or secure that information during transmission and the periods o f time during which those measures were in effect.

(4) Have you at any time stored information from or about a user’s address book? If so, which field? Also, please describe all measures taken to protect or secure that information during storage and the periods of time during which those measures were in effect.

(5) At any time, has your iOS app transmitted or have you stored any other information from or about a user’s device – including. but not limited to, the user’s phone number, email account information, calendar, photo gallery. WiFi connection log, the Unique Device Identifier (U DID), a Media Access Control (MAC) address, or any other identifier unique to a specific device?

(6) To the extent you store any address book information or any of the information in question 5, please describe all purposes for which you store or use that information, the length of time for which you keep it, and your policies regarding sharing or that information.

(7) To the extent you transmit or store any address book information or any of the information in question 5, please describe all notices delivered to users on the mobile de vice screen about your collection and use practices both prior to and after February 8, 20 12.

(8) The iOS Developer Program License Agreement detailing the obligations and responsibilities of app developers reportedly states that a developer and its applications — may not collect user or device data without prior user consent, and then only to provide a service or function that is directly relevant to the use of the Application, or to serve advertising.” (a) Please describe all data available from Apple mobile devices that you understand to be user data requiring prior consent from the user to be collected. (b) Please describe all data available from Apple mobile devices that you understand to be device data requiring prior consent from the user to be collected. (c) Please describe all services or functions for which user or device data is directly relevant to the use of your application.

(9) Please list all industry self-regulatory organizations to which you belong.