Omniture, Apple, iTunes, and Privacy · 529 words posted 01/11/2006 01:17 PM
More fun with iTunes and Apple’s Privacy Policy, updating earlier posts here and here:
Merlin has posted a screenshot of iTunes contacting 207.net (thanks to Cory Doctorow at BoingBoing for publicizing this).
I’ve installed Little Snitch and can confirm this behavior: if you launch iTunes on a Mac with the new MiniStore open (and it’s open by default), iTunes attempts to contact 207.net, otherwise known as Omniture. See the screenshot above. And why on earth does a third party need to bury its IP address behind a string that looks like an intranet (local) address?
Should we care? You decide. Here’s the relevant language from Apple’s Customer Privacy Statement. I apologize for quoting at such length, but I don’t want to take their language out of context:
Apple takes your privacy very seriously. Be assured that Apple does not sell or rent your contact information to other marketers. To help us provide superior service, your personal information may be shared with legal entities within the Apple group globally who will safeguard it in accordance with Apple’s privacy policy. There are also times when it may be advantageous for Apple to make certain personal information about you available to companies that Apple has a strategic relationship with or that perform work for Apple to provide products and services to you on our behalf. These companies may help us process information, extend credit, fulfill customer orders, deliver products to you, manage and enhance customer data, provide customer service, assess your interest in our products and services, or conduct customer research or satisfaction surveys. These companies are also obligated to protect your personal information in accordance with Apple’s policies. Without such information being made available, it would be difficult for you to purchase products, have products delivered to you, receive customer service, provide us feedback to improve our products and services, or access certain services, offers, and content on the Apple website.
Leave aside for the moment the plain meaning of Apple’s privacy language, which seems to say, “We won’t share your information with marketers, but we’ll share your information with people who do pretty much everything that marketers do.”
Let’s look at Omniture. Here’s their privacy policy, again quoting at length to avoid distorting their words:
Omniture knows that privacy is a critical part of a positive online experience—and that you need to feel confident your privacy is always being protected.
Omniture gives you every assurance that while you are on this Web site or using its products and services, your information is secure.
Omniture’s measurement tools are used to improve Web site design, to help market products and services more effectively, and to generally improve your user experience.
Omniture is committed to monitoring, adopting, and following the highest standards of privacy in the industry.
I’ve also attached a screenshot of Omniture’s privacy page. It’s unclear why the gentleman is so happy; possibly he’s just found out that his privacy is safe with Omniture and Apple, or maybe he’s happy to have received YOUR iTunes data—mmmm, now that’s some good marketin’! We just don’t know.
Either way, by its own admission Overture appears to be a marketing firm.
* * *
3. On Jan 11, 03:34 PM since1968 said:
Ward, here’s a screen capture of the updated iTunes. The MiniStore is the panel at the bottom of the app that says “Inside the Music Store” and “More from Mary J. Blige & U2.” #
4. On Jan 11, 03:44 PM Kelly said:
Have you ever ripped a CD with iTunes? If so, how do you think it automagically fills in the ID3 tags with artist, album, title, etc?
Unless you painstakingly entered that information yourself, they already know every CD you have ripped into your collection.
Have you ever bought a song from iTunes? If so, how do you think they have been customizing recommendations before 6.0.2 was ever released?
This is just another non-issue being blown all out of proportion by a certain Creative Communist. #
5. On Jan 11, 03:45 PM awmyhr said:
The only thing I can see that Apple messed up on here is making it clear what is happening and why. The ‘MiniStore’ is designed to make recommendations based on what you have in your library, logically, this requires some kind of way for iTunes to tell iTMS what you have in your library. ONLY when you have the MiniStore enabled, iTunes transmits (AFAIK) ONLY the title and artist of tracks AS YOU CLICK on them, getting a return data of recommendations, which is displayed in the MiniStore.
Explicit acknowledgment of this, as well as as statement on if the data is kept or tossed after each recommendation, would seem to be all that is required from Apple at this point. #
6. On Jan 11, 03:58 PM since1968 said:
Kelly, your arguments differ from the Omniture issue in two critical ways:
First, the behaviors you discuss are transparent to the end user (the Omniture ping is invisible without the aid of third party sniffing software).
Second, the “automagically” filled tags are obtained from Gracenote, and the Gracenote software is explicitly covered in the license. Remember: I’m not dinging Apple for actions that are obvious or are clearly covered by plain language in their EULAs. I’m complaining about behavior that’s designed to be undetected by the average end user and pretty clearly falls outside the scope of their privacy policy. To my mind, that’s not a trivial difference.
The comment about a “certain Creative Communist” is just goofy. #
8. On Jan 11, 04:51 PM Trukadero said:
While I agree that Apple could have been more explicit around this new way of sending listening habits over the pipes (something I’d gladly opt-in for in search of a more integrated last.fm-like experience) I also think that this might be getting a lil’ blown out of proportion. In my experience, Apple is very careful about doing the right thing vis a vis customer data. And Omniture isn’t a marketing company—they help Apple do click-stream analysis; they help to help answer questions like: “Why is everybody dropping off from this page in the iTunes Music Store…is there bad navigation on there?” #
9. On Jan 11, 04:52 PM Kelly said:
Unless the end user knows nothing about computers, he or she will realize that the Ministore’s recommendations are based on his or her listening habits, not some kind of magic. The Ministore is perfectly transparent in that it takes up 20% of the iTunes window when it is on and plainly responds to the user’s behavior. Don’t like it? There are at least three ways to turn it off, including an icon placed conveniently in the main window.
Furthermore, did you miss this bit about the itunes ministore:
“Looking for some new tunes? Tap into the 2-million-song treasure chest of the iTunes Music Store through the new MiniStore. While you’re browsing your own library or importing a new CD, MiniStore appears at the bottom of the iTunes window and shows you other albums from your favorite artists and artists like them. You can even see reviews of these albums plus what other listeners who like this artist purchased — so you’ll never be at a loss for new music to discover. When you’re ready to go back to full-screen mode, click an icon and MiniStore tucks away, ready to pop up again later when you want to explore some more.”
http://www.apple.com/itunes/playlists/
or this:
“Discover new music as you enjoy your collection or import new CDs — with MiniStore.”
http://www.apple.com/itunes/
Both of these descriptions seem pretty clear to me and provide as much information as the typical end user would want. They are also placed where anyone can see them.
Finally, these activities are covered in the license that you quoted:
“There are also times when it may be advantageous for Apple to make certain personal information about you available to companies that Apple has a strategic relationship with or that perform work for Apple to provide products and services to you on our behalf. These companies may help us process information, extend credit, fulfill customer orders, deliver products to you, manage and enhance customer data, provide customer service, assess your interest in our products and services, or conduct customer research or satisfaction surveys. These companies are also obligated to protect your personal information in accordance with Apple’s policies. Without such information being made available, it would be difficult for you to purchase products, have products delivered to you, receive customer service, provide us feedback to improve our products and services, or access certain services, offers, and content on the Apple website.”
So, even if you disagree with the Omniture thing being kept in the background where no one can see, the license covers this. It allows Apple to give certain customer information to third parties in order to provide services on Apple’s behalf. “These companies are also obligated to protect your personal information in accordance with Apple’s policies.” If this isn’t good enough, what is? My recommendation is to stop using iTunes entirely or use Little Snitch full-time.
End users don’t care about Gracenote or iTunes Music Store profiles and they won’t care about the Ministore. Even if they did, apple’s own website plainly says that it is based on the user’s behavior and that the information is being taken and used to make recommendations. Furthermore, this is all covered by the EULA, which protects personal information to Apple’s own policies, even when the information is being gathered by a partner.
Don’t like it? Then don’t use iTunes. Or click the little icon that closes the Ministore. Big deal.
Oh, and reference this post to see more knee-jerk ranting. I believe it is entitled ’ “Apple to iPod owners: “Eat shit and die” ’
http://www.boingboing.net/2004/10/30/apple_to_ipod_owners.html #
10. On Jan 11, 05:37 PM Kelly said:
Two more things. You can hang your criticism on various definitions of the word “marketers”, but it is clear that the third party partners are authorized to do certain kinds of work on behalf of apple: “These companies may help us process information, extend credit, fulfill customer orders, deliver products to you, manage and enhance customer data, provide customer service, assess your interest in our products and services, or conduct customer research or satisfaction surveys.”
In other words, they are providing services for Apple, not solely for their own interests or for those of an unauthorized party.
Second, they are legally bound by Apple’s privacy rules: “To help us provide superior service, your personal information may be shared with legal entities within the Apple group globally who will safeguard it in accordance with Apple’s privacy policy.”
In other words, Apple has protected your information by extending their policies to parties they do business with.
As an example, Apple contracts with Fedex to deliver hardware purchases made on their online store. They give Fedex a lot of your personal information including name, address, phone number and other information from which Fedex could easily determine the value of, if not exactly what you were buying. If Fedex wanted to, they could build a huge database of Apple customers’ buying habits, from how much they spend, when they tend to buy, etc. For that matter, they could do it with the customers of every online retailer that contracts with them to handle shipping. This would be a huge database. Then they could sell this information to the highest bidder. Why don’t they? Because they are legally bound to the privacy terms of each individual company that they do business with. Why is it in their interest to abide by these rules? Because the value of their shipping contracts is worth more than selling customer information.
Same thing applies to Apple itself. Why would they risk the PR problems associated with selling marketing information when it could effect their X Billion in sales? It simply isn’t worth it.
This is why people aren’t up in arms about Apple letting Fedex knowing exactly where you live, what you order, when you order, collecting your signiature, sending an agent to your house, etc etc etc etc. #
11. On Jan 11, 05:41 PM anonie said:
BTW, I agree with you – corporations need to be didactic about the information they compile AND how they protect it. As for those who think corporations knowing about their listening isn’t a big deal…the same architecture can and will be used for tracking DVD (movie) playback…so… those watching pornos beware! #
13. On Jan 12, 03:34 PM James Anders said:
just block omniture at the firewall:
216.52.17.0 – 216.52.17.255
or use sh0rtie’s Hosts file with 99% of omnitures domains in
http://hostsfile.mine.nu/downloads/ #
15. On Jan 13, 05:50 PM denka said:
One important thing not to be missed, is that with cookies it is IMPOSSIBLE to stop tracking the transition of a user from one site to another. Since cookies are always sent to the same domain 207.net, 207.net knows that you’ve been to a.com, then moved to b.com (and the pages you’ve visited on them, too). #
16. On Jan 14, 05:17 PM Justin said:
Just because I work in the online marketing industry and regularly run into people from Omniture and am familiar with their application, I can tell you that Omniture, while their tools do collect information that identifies unique visitors/sessions, they don’t identify YOU personally. What I mean is that when you go to a site that uses Omniture, you’re basically assigned a number that’s used to do tracking. They don’t collect your email address or other personally identifiable information. I can tell you though that marketers are DEFINITELY interested in “tying” together your unique number with your personal information, and a lot of really high-end marketers are actively working on projects or have recently implemented projects that marry the two together. #
18. On Jan 16, 03:08 AM denka said:
Justin, you appear to be as shalow as marketing people are. Go ask (for chris’s sake, for once!) your knowledgeable IT folks about cookies and how they work. You may still be delusional about what Omniture promises you. Would not be surprised if your company has alrady implemented AJAX based form optimization. (This is their solution that sends form field data BEFORE a user has clicked on the submit button. Partial inputs are welcome… Even if you decided at the last moment to not to submit the data, the website operator has already got it for “website optimization purpose”.) #
19. On Jan 16, 08:22 AM since1968 said:
Justin, you might be right, who knows?
What we do know is that the Omniture IP is often buried behind a string that’s intended to look like it’s on your local network. We also know that Omniture is not mentioned in any of the legal agreements governing use of iTunes or iTMS.
Surreptitious behavior invites informed questioning. It’s up to Apple and Omniture to clear things up. #
20. On Jan 24, 01:39 AM steve said:
Just wondering why marketers feel that they are entitled to information that could potentially reveal private data. Also, why aren’t they totally upfront about their activities (i.e. don’t bury their activities in arcane fine print)if they are so freaking benevolent and harmless. Personally, I don’t feel comfortable with an entity that hides itself but tries to insinuate itself into my private life, sort of like government. #
21. On Jan 24, 11:51 AM ade said:
My trust maybe mis-placed but, well after over a decade of Apple usage I am not at all worried by this. (Well observed tho)
Personally I dont rate Mini-store, I know what I want to listen to and don’t need its ‘advice’.
Apple is trying to ‘up’ it’s iTunes music sales is all. In order to make it’s ‘suggestions’ the .app HAS to access a database surely?
I agree that Steve shoulda mentioned this, and I guess if it was Bill rather than Steve I’d feel differently.
Perhaps I should be a little more paranoid? :P
I know its already been said but… turn it off? #
1. On Jan 11, 03:04 PM Will said:
Jobs: “One More Thing… I’m selling your personal information to a marketing company so I can flood you with ads for albums that you already own!”
The crowd goes nuts. #