Privacy of Apple Podcasts
But not all of Apple’s products are as private as they should be. And one of them, which doesn’t have a privacy label since it’s part of the underlying OS, is built very poorly indeed when it comes to privacy.
[…]
Apple Podcasts doesn’t use a computer server in the cloud for this sort of thing. Instead, by design, every copy of the Apple Podcasts app checks each RSS feed you’re subscribed to.
[…]
Apple Podcasts don’t tell you who hosts the podcast you’re subscribing to: it’s not surfaced anywhere in their app.
So, you’ve no knowledge as to whether this personal data is going to a nice, sensible podcast hosting company, or one that isn’t so nice: since it’s not clear anywhere within the podcast app who is the hosting company.
I think this is a bit of an exaggeration. This is not personal information being sent. And fetching the feeds directly is arguably more private since it doesn’t (if you turn off syncing) involve a central cloud service that knows every feed that everyone subscribes to. (Overcast mitigates this by allowing anonymous accounts.) Would you say that Safari should be made “more private” by proxying all requests through Apple’s servers?
Previously:
- Apple’s “Privacy Nutrition Labels” Are a Blessing and a Curse
- iOS App Privacy Labels
- Overcast 4.2: The Privacy Update
Update (2021-01-06): Apple Podcasts does have a privacy label.
6 Comments RSS · Twitter
I obviously agree with Michael's and Lukas's assessment — whether deliberately or as a side-effect of not wanting to run servers, Apple's approach is clearly more private.
A few things I'll note:
• it is… weird that they supposedly change their UA string to match the localized app name. The author notes this as a privacy risk (it does improve the fingerprint, sure), but that seems a bit of a stretch. However, I don't see the point, either: Apple _should_ send the Accept-Language header if they want to distinguish based on that, but to what end?
• Overcast has recently added little privacy information cards. This is a useful feature others should adopt. If it were something that could scale (it probably isn't), Safari should do it for any web host. True to form, an Apple podcast I listen to is fairly private: there's no analytics, no tracking, no dynamic ad insertion, etc.
I'm ambivalent about the proliferation of privacy cards. I like the principle, but I fear that for most people, they'll quickly fall into the same category as those "Do you want to accept all cookies?" banners that show up on the bottom of web pages.
"Yeah, yeah. Sod off. You a**es already know everything about me anyway."
Apple's privacy cards have one distinct advantage: they're published by a single source. That means they're uniform in structure and format, and there's someone with skin in the game who doesn't want them to simply be bullshit.
The "do you want to accept all cookies?" banners are truly useless. It seems like they were added as a consequence of the EU Cookie Directive, but 99% of them don't comply with that Directive. They're annoying with no benefit to anyone.
My fear with Apple's privacy cards is that some of the (self-reported!) claims are false, with no external verification or even a way for users to report them when they're lying.
@Ted And your fears are well grounded. Apple can’t be the be-all and all of privacy and security. In practice we’ve all seen that they suck, and that their so-called “security measures“ have more to do about control than user privacy and security.
Let’s not get into the entire network bypass of any Apple service on big sur.
Apple can’t security. They need to do what they did before, have a good baseline and leave specialized “threats” to vendors.
Furthermore it’s now apparent that “Apple can’t RSS” either if they’re not going to disclose feed URIs to endusers.
This all goes back to Apple not being user-centric anymore “because it’s not required for the user to know” —and this is why users are better off deleting Apple’s lowQual apps and using something better like FieryFeeds and OverCast.
I like the principle, but I fear that for most people, they’ll quickly fall into the same category as those “Do you want to accept all cookies?” banners that show up on the bottom of web pages.
There’s always a risk of alert fatigue, yes.
The “do you want to accept all cookies?” banners are truly useless. It seems like they were added as a consequence of the EU Cookie Directive, but 99% of them don’t comply with that Directive. They’re annoying with no benefit to anyone.
Yup. (For example, if you use cookies in order to save a login session, you do not need a banner for that.) I suspect a few willfully implemented it in an overly draconian way, in order to paint the EU in a poor light, but then the vast majority just cargo-culted everyone else.
My fear with Apple’s privacy cards is that some of the (self-reported!) claims are false
I am a bit surprised how honest companies like Facebook are. As has been widely reported, it’s striking just from how many types of data are listed.
Yeah, that seems super backwards. You kind of have to twist your brain into a pretzel to come to the conclusion that having an intermediary service that tracks everything you do is somehow helping your privacy.