iPhone analytics data could identify a user

Is the fortress built by Apple to protect user privacy built on sand foundations? In any case, new revelations cause some confusion regarding the manufacturer’s practices. Security researchers Tommy Mysk and Talal Haj Bakry have thus discovered that the analytical data sent by the iPhone contains a unique identifier, dsId (for Directory Services Identifier).

???? New Findings:
???? 1/6
Apple’s analytics data include an ID called “dsId”. We were able to verify that “dsId” is the “Directory Services Identifier”, an ID that uniquely identifies an iCloud account. Meaning, Apple’s analytics can personally identify you ???? pic.twitter.com/3DSUFwX3nV

— Musk ???????????????? (@mysk_co) November 21, 2022

This unique dsId being attached to an iCloud account, Apple would therefore have the means to trace the individual user and the related information (name, date of birth, email address, data stored in iCloud). In the legal notices consecrated to device analysis and privacy, however, Apple assures that ” none of the information collected identifies you personally “. Is it only true?

In the Analysis and improvements > Analysis and improvements > Analysis data settings, you can access the data collected by the apps, but it is unreadable for ordinary mortals.

Apple nevertheless specifies that in the case of sending data from several devices using the same iCloud account, the manufacturer can ” link certain Apple app usage data across these devices through end-to-end encrypted synchronization ».

Apple immediately adds that the method used (dsId?) does not allow the user to be personally identified, and the end-to-end encryption seems to protect the user’s identity well. Nevertheless, the very existence of a unique identifier raises questions.

Analytics data is used by Apple to improve its products and services. It is possible not to share this information with the manufacturer (the option Share Analysis (iPhone + Watch) in the screenshot on the left).

This discovery is in addition to the recent one concerning the App Store. The store also collects personal information in a way that doesn’t seem to quite match Apple’s rhetoric. Besides, a class action has been brought on this basis against the builder.