Mobile App Providers Agree to Tighten Privacy Rules, Increase Disclosure to Consumers

Apple, Google, Amazon and other companies representing 95 percent of the platforms for downloading mobile applications have agreed to boost privacy protections on the 1 million apps they provide to consumers around the world.

The agreement was announced February 22 by California Attorney General Kamala Harris who hailed it as a boon to consumers who will now know what information from their phones or pads an app will or won’t share with third parties.

“(We’re) giving more information to the consumer so they understand how this technology can be used and how their personal private information can be used and manipulated,” Harris said at a San Francisco press conference.

Apps — for everything from games to travel, music and education — can automatically determine a user’s location, their phone number, list of contacts, call logs and other detailed information which, in turn, can be shared with a large number of others.

The platform operators now will insist that the makers of the apps identify what information of a potential consumer would be collected – if any –and how that information would be used.

Consumers would have access to that disclosure prior to downloading the app.

Apple and Google, creator of Android, dominate the marketplace, offering between them some 1 million different apps – up from 600 when they launched in 2008.

In a statement, Google, welcomed the agreement. It cited its existing commitment to privacy protection by the use of its  “permissions” screen, which appears just before installing an app. On it, app designers are required to share their product’s capabilities.

The Federal Trade Commission said recently that, while helpful, such disclosures “do not explain clearly — or provide an easy means for consumers to learn — why an app has the permissions it does, what the app does with such access or whether the app shares any information with third parties.”

Apple says it screens apps to protect consumer privacy and won’t offer apps that grab personal data without permission.

Harris’ announcement comes on the heels of a Federal Trade Commission report released earlier in the month criticizing the lack of disclosure about data collection and sharing practices in hundreds of apps aimed at children.

“The mobile app marketplace is growing at tremendous speed and many consumer protections, including privacy and privacy disclosure, have not kept pace with this development,” the trade commission writes in Mobile Apps for Kids: Current Privacy Disclosures are Disappointing.

“Parents should be able to learn, before downloading an app for their children, what data will be collected, how the data will be used and who will obtain access to the data,” the commission concluded.

The report calls on app stores to do more to police the app developers and enforce the rule they reveal any information their apps collect and its uses – a similar requirement to what the stores agreed to do with Harris.

The agreement establishes that mobile apps are subject to California’s Online Privacy Protection Act – one of the first and toughest of such laws in the country.

Being subject to the act requires operators of websites and providers of online services – like apps — who collect information about Californians to conspicuously post a privacy policy.

That means app developers must tell consumers what, if any, information they collect and share. Platforms, like Apple and Android, would be responsible for app developers meet that mandate.

There is no uniform language for the disclosures, which means they could be similar to the largely impenetrable statements that appear with software to which most users simply click “I agree” without reading.

Even if the disclosures are dense, their existence is positive, according to Sen. Joe Simitian, a Palo Alto Democrat, who authored the online privacy law in 2003.

“Yes, this agreement empowers individual consumers but in the real world what often happens is privacy groups who are particularly concerned about these issues will have the opportunity to see what the privacy policies of these apps are — or are not — and make them better known by the public.”

Harris said she expected the parties to the agreement to begin complying immediately but said she would meet again with the apps platforms to assess their progress in six months.

“This is meant to be an understanding based on good faith between the industry and government,” Harris said. “We will assume that everyone will act in good faith. (But) once someone crosses that line, there will be a different response which is litigation and enforcement.”

Reporter Questions from the Press Conference

-30-