Apple App Store analytics data can be used to identify users, claims iOS developer

An iOS developer claims that Apple’s App Store analytics data has identifiers that can be linked to a user’s iCloud account. This means that the App Store analytics data can be used to personally identify a user, contrary to Apple’s claims that none of the information collected as part of device analytics can identify a user personally. 

“Apple’s analytics data include an ID called ‘dsId’. We were able to verify that ‘dsId’ is the ‘Directory Services Identifier’, an ID that uniquely identifies an iCloud account. Meaning, Apple’s analytics can personally identify you,” Tommy Mysk, an iOS developer and security researcher, said in a Twitter post, published Monday. Mysk posted a series of tweets after this in which he explains how DSID can be used to identify users. 

Mysk explains that Apple uses DSID to uniquely identify Apple ID accounts and is associated with a user’s name, email, and any data stored on the iCloud account. Mysk also posted a screenshot of an API call to iCloud, which shows DSID along with the user's personal data.

“The analytics data that the App Store sends to Apple always contains an ID called ‘dsId’. We weren't sure if this was the same as the DSID, the ID that uniquely identifies an iCloud account. We confirm that they're the same ID,” he added in another post. 

Mysk also refers to Apple’s device analytics and privacy policy page, which states that none of the collected information for iPhone analytics identifies a user personally. It also states that personal data is not logged at all, is anonymized using privacy-preserving techniques, or is removed before they are shared with Apple. 

On the other hand, Apple in its App Store Privacy policy page acknowledges that it collects users’ personal data to provide the content they purchase, download, or want to update in the App Store and other Apple online stores. It also uses data on purchases, downloads, and other activities in the stores to improve the store, offer personalized recommendations, and send Apple marketing notifications. Users who are not comfortable with this can choose to not share their data by switching off personalized recommendations in the App Store. 

Unlike other big tech companies such as Google, Amazon, and Meta that rely on user data for their ads and other businesses, Apple has positioned itself as a more privacy-oriented company that values users' privacy and strives to give them more control over what data they want to share or not share with app developers and advertisers.