All New and Updated App Store Apps Required to Have a Privacy Policy Starting October

[rorschach]

How about a “Screen Time”-like feature, but for privacy? Have a section in Settings that breaks down which apps have accessed what data (photos, contacts, location, etc), how often they’ve done so, etc.

That alone would do far more for transparency than pages of legalese on a website.

Also, for Photos, the only option to allow an app to access photos it to allow access to the entire library. Make it so that, as an option, the app only gets what photos you select in the photo selection view.

Same for contacts. Let me select specific contacts to share with the app with a standard contact chooser view. And let me exclude specific contacts from being shared even if I allow access to my full contacts.

Give an option to only temporarily allow location access to an app for a set amount of time - like you can when you share your location via iMessage.

 

[MacBH928]

This is like the smoking kills warnings on cigarette boxes. Didn't stop the smokers, and never hurt the tobacco companies.

Data collection as a form of business should end. "Give me all your data or nothing works" practice should end. 4 companies operating the internet without alternatives should end.

The default should be 0 data collection. DEFAULT.

And these privacy policies are worth nothing, Facebook and Google have been caught multiple times collecting data unethically and they didn't even get a slap on the hand.

 

[Substance90]

This is like the smoking kills warnings on cigarette boxes. Didn't stop the smokers, and never hurt the tobacco companies.

Bad analogy. Any business with a significant marketshare in Europe has had to completely overhaul the way they deal with customer data this year.

I was part of the effort to become GDPR compliant in one of the largest energy analytics companies in the world and I can tell you it was a gigantic effort on part of many people. Currently they only store their customers emails, not even first name, last name or anything like that. We are talking first party here. You can forget about third party services likes of Google Analytics and loading social sharing buttons on your site by default.

 

[Bin Cook]

The creeping corporatism of Cook continued apace. This measure is there to favour the big guys and kill off the small ones. Why should apps like mine that access no private data need to have a lawyer on call or spend time creating and maintaining a website to store terms? The whole point of the App Store is that it can be wholly contained eco system ffs.

 

[Kaibelf]

I think Apple should change policy on allowing apps access to people's contacts (such as WhatsApp). I don't like that they can—often with a single single tap, without knowing too much of what's being asked—hit "Ok" and upload their full address book (including my entry) to Zuckerberg's servers without my more acute understanding re potential consequences of said seemingly innocuous action. And without our permission. What did one dev. say, "it's the wild-west of data collection". Given how much Apple care about security, I'm surprised Apple still allows this.

I’m confused. You want Apple to force developers to inform you a second (or more) time about what you are agreeing that you read, understand, and accept? At what point does common sense come into play? Do you randomly sign paperwork without taking the time to look through it? After all, that is innocuous too until the new family comes to move into the house. Apple isn’t the one allowing anything. You are, when you decide that you just can’t be bothered and click through because you REALLY feel an overwhelming urge to use some app.

 

[waquzy]

Downloaded, installed and the bug is gone - iPhone SE

 

[Bin Cook]

Shame iAds is dead. If I ever wanted to monetize my app I could have posted a link to iAds and put it back on Apple. How on Earth do you write a policy covering any Google ads in your app?

 

[0815]

Just wrote mine. What a pain. I don’t collect any information. Would be nice if we could just check a “we don’t collect anything” box in appstoreconnect.

yes - there should be the option 'i don't do that ...'

also would be nice if google would provide templates that everyone can copy based on which services are used - e.g. I don't know what to put there if I use AdMob since I don't know what google actually collects ...

 

[rorschach]

The creeping corporatism of Cook continued apace. This measure is there to favour the big guys and kill off the small ones. Why should apps like mine that access no private data need to have a lawyer on call or spend time creating and maintaining a website to store terms? The whole point of the App Store is that it can be wholly contained eco system ffs.

You do not need a lawyer on retainer to draft a simple privacy policy - particularly if you’re not collecting data, as you say. A privacy policy is not the same as an EULA or terms & conditions

And websites are dirt cheap these days. At the very least you ought to have a domain so that you can maintain an email address for users to contact you.

 

[Bin Cook]

yes - there should be the option 'i don't do that ...'

also would be nice if google would provide templates that everyone can copy based on which services are used - e.g. I don't know what to put there if I use AdMob since I don't know what google actually collects ...

And Apple has now made you liable by expecting you to guarantee Google’s activity.

WTF?

 

[EdT]

To summarize:

• Since the EU already requires and enforces most of the points Apple is requiring it’s obviously possible to do.
• Small businesses will probably suffer because they don’t have the resources to do this quickly and may be relying on a 3rd party (Google, Facebook, etc) because that’s how the small business manages to monetized the app.
• Because it’s not a mandatory requirement by the US & Canada for software like in Europe small companies will likely quit supporting IOS and large companies will just continue ignoring it.

 

[Cosmosent]

Just wrote mine. What a pain. I don’t collect any information. Would be nice if we could just check a “we don’t collect anything” box in appstoreconnect.

That's an Excellent Idea !

 

[fairuz]

My little side-project app will only have usernames and nothing else. I'm definitely going to give them something not pro level for that and hope they take it. I doubt they're asking for a lawyer to write something. Still, a bit annoying that there's yet more crap to fill out.
[doublepost=1535773312][/doublepost]

Shame iAds is dead. If I ever wanted to monetize my app I could have posted a link to iAds and put it back on Apple. How on Earth do you write a policy covering any Google ads in your app?

Exactly, I really don't get why iAd is dead, such a suitable method of advertising on iPhones. Also, some app I wrote years ago in high school used iAd, and I remember it being way easier to set up than Google's ads.
[doublepost=1535773601][/doublepost]

Bad analogy. Any business with a significant marketshare in Europe has had to completely overhaul the way they deal with customer data this year.

I was part of the effort to become GDPR compliant in one of the largest energy analytics companies in the world and I can tell you it was a gigantic effort on part of many people. Currently they only store their customers emails, not even first name, last name or anything like that. We are talking first party here. You can forget about third party services likes of Google Analytics and loading social sharing buttons on your site by default.

What a mess. Honestly GDPR seemed like nothing but a way to target foreign corps that would have a harder time ensuring compliance. And now every site I visit asks me with an annoying popup if I want to allow cookies cause that's part of compliance.

 

[Z400Racer37]

The problem is nobody reads privacy policies. Apple needs to have a standardized privacy seal of approval, where if an app meets certain general standards of privacy that Apple sets, it will show a logo letting people know that it meets Apple's high standards of privacy.

 

[Tech198]

Me too. If they’re readable.

English translation would be needed. "Apple gets tough on privacy"

 

[MacBH928]

Bad analogy. Any business with a significant marketshare in Europe has had to completely overhaul the way they deal with customer data this year.

I was part of the effort to become GDPR compliant in one of the largest energy analytics companies in the world and I can tell you it was a gigantic effort on part of many people. Currently they only store their customers emails, not even first name, last name or anything like that. We are talking first party here. You can forget about third party services likes of Google Analytics and loading social sharing buttons on your site by default.

1-Thank god you live in Europe because elsewhere people don't get to enjoy the GDPR benefits, its up to the corporate greed ethics. Also how does this work if I have Gmail account, what if I login when I am traveling to say USA? Do they start hoarding data on me because I am outside of Europe jurisdiction?

2-GDPR is a step in the right direction, we are not there yet. Whats worrying is that you don't know what is collected about you or how it is shared, they say its in the privacy policy but I am not going to read pages of privacy policy for each app and service I use and decrypt the "legal terms".

Even when companies get caught breaching privacy policy, all they do is "We are sorry, we will not do it again". Like Facebook recently. There was this service that actually SHUTDOWN, it no longer exists for few years. They at least still have my email!!

 

[EdT]

The problem is nobody reads privacy policies. Apple needs to have a standardized privacy seal of approval, where if an app meets certain general standards of privacy that Apple sets, it will show a logo letting people know that it meets Apple's high standards of privacy.

Someone averaged the amount of time someone would need to read all of the consent documents that people have to deal with in North America and it was at least a couple hundred hours. That’s ignoring the ability to actually understand the legalese in the document or the escape clauses put in by companies to try to divert responsibility.

 

[StyxMaker]

The creeping corporatism of Cook continued apace. This measure is there to favour the big guys and kill off the small ones. Why should apps like mine that access no private data need to have a lawyer on call or spend time creating and maintaining a website to store terms? The whole point of the App Store is that it can be wholly contained eco system ffs.

I’m sure there was a mention of entering the privacy policy directly into the App Store for developers who don’t have a web site.

 

[cjrzasa]

Not sure if this was said, just got here...so they just have to provide a link to their privacy policy? So they can change their privacy policy in the app or the link to it as they provide updates to the App Store. So what happens when they change what's on the web after you click that link? The URL hasn't changed but the content surely can by the minute...

 

[jimbobb24]

So they will be required to put some legalese on their app? How about requiring them to ask for permission to access the internet and specify why they want to access it? The best privacy protections are not legal fictions but building walls and doors they need our permission to cross.

 

[AdonisSMU]

That’s my concern too.
Another aspect I’ve read is that the app must include a link to the privacy details whether the app is web enabled or not. So without more clarification it looks like a small developer would have to then have a website that the app can connect to just to tell the user that they’re not collecting anything and that except for that link it wouldn’t otherwise have even connected to the net?

This was my initial thought.

 

[Bin Cook]

I’m sure there was a mention of entering the privacy policy directly into the App Store for developers who don’t have a web site.

I’d hope so. Some very valuable apps exist as service to communities and developers are providing them for free whikst bearing the cost of the dev account. Apple requiring devs to bear even more costs is anti-social and exclusionary in those cases. Not every app exists to make money (bloody Commies...).