Filed under: Macworld, iLife, iTS, iTunes
iTunes 6.0.2 spies on you

OK, it isn't quite that bad, but iTunes does send data back to an Apple related service while you are listening to music in your library and have the 'mini-store' open. Why does it do this? So it can recommend stuff based on what you are currently playing. Boing Boing, that den of privacy loving liberals (warning, some of the stuff on Boing Boing isn't safe for work) has a nice roundup about this.

Get a WordPress.com Blog
![TUAW [Cafepress]](http://www.blogsmithmedia.com/www.tuaw.com/media/tuaw-cafepress-promo.png)


Reader Comments (Page 1 of 2)
K said 12:54PM on 1-11-2006
It does this to sell more music in the iTunes Store; plain and simple. Perhaps too it's taking user listening data to compile for market research purposes, but I would say this is secondary.
Reply
gr33n said 1:16PM on 1-11-2006
and when you click on song preview button in itunes while in itunes music store, IT SENDS INFO ABOUT WHAT SONGS YOU ARE PREVIEWING directly to apple ... i mean, there was no sign saying that it will do so ...
Reply
Scott Stevenson said 1:17PM on 1-11-2006
Heh, makes me laugh... the moment I saw that 'feature' I was hoping that it was something that could be disabled. I was dreading the idea of having to have forced advertising when using iTunes to manage my music and iPod. Thankfully after a bit of searching in the menu items I found in the 'Edit' menu a "hide mini store" choice... natch... took care of that... and also the little icon forth from the right in the lower left hand corner of the iTunes window.
-Scott
Reply
Scott Stevenson said 1:22PM on 1-11-2006
"icon fourth from the right in the lower right hand corner of the iTunes window" rather...
-Scott
Reply
djones said 1:24PM on 1-11-2006
As I mention in my own blog posting, available via my name link, this still constitutes as spyware. Yes, it's not malicious, yes, it's a trusted company. I'm not angry, but disappointed that Apple would do this without overtly letting the user know, and giving them a clear opt-out.
And yes, the data is also sent to Omniture, a web stat and analysis marketing firm, which Apple also recently began using to monitor web traffic on their site.
Neither are harmful or bad, but it's legtimizing non-disclosed transmission of data, and it's existence and use by such a large company could possibly provide legal validation and defense for more grey-area or directly malicious use of spyware.
Reply
Scott Stevenson said 1:31PM on 1-11-2006
Is it just me or does there appear to be 4 comments missing here (the count shows 5 but only 1 displays)?
-Scott
Reply
K said 1:37PM on 1-11-2006
A note on AirFoil, the demo I tried out displayed a small but noticeable delay between the two speaker sets. So if the rooms are nearby this is annoying. Seems like the iTunes update though doesn't have this problem.
Reply
K said 1:40PM on 1-11-2006
Agreed that Apple should be more forthcoming about the mini store, but we shouldn't forget that this software is free thanks to the revenue of the iTunes Store!
Reply
mr.dave said 1:49PM on 1-11-2006
I don't think it's spyware per se - spyware works in the background without you realizing it. Anyone who uses the mini store and gets recommendations is likely to relate it to using Amazon or something similar. So, of course they have to get your listening information somehow. Seems pretty obvious to me. And those who cry foul may want to read the EULA. I'm not saying it's mentioned in there because 1) I haven't updated yet and 2) who really reads those things? While I do believe Apple could've been a bit more forthcoming with this, I also think it's well within their rights - especially if it's mentioned somewhere in the EULA and you click "Accept" - otherwise, just close the mini-store and go about your business, or listening rather.
Reply
hauk said 2:04PM on 1-11-2006
This is foul play by Apple - and stupid of them. You can turn of the mini-store Window by clicking on a button, but far better is to go into -> Parental and disable the Music Store demonstratively for all entirety and fire up Limewire instead and get your music there.
Reply
The Jeremy said 2:09PM on 1-11-2006
Get over it. This is no different than TiVo tracking what you watch, except maybe for the fact that we aren't talking about aggregate data here.
The upside is, if a lot of people listen to indie music, it might somehow improve their status in the iTunes Store if they have a distribution agreement in place...or it might encourage Apple to inquire with the band about such an agreement...
Another step in the direction of destroying the RIAA.
Reply
Charles said 2:22PM on 1-11-2006
How much more 'forthcoming' can apple be?! The window displays information WHILE your music is playing. It's not doing it invisibly, it's not doing anything different than clicking on the 'go to iTMS' arrow does, except automatically.
Seriously people, this is no different than doing a 'search' in amazon OR iTMS! There's nothing to see here folks, please resume your tin foil hat creation.
Reply
hydo said 2:26PM on 1-11-2006
What the hell do you expect? When you click on a song, it shows you the relevant albums, artists, and songs from the itunes store. I don't understand why everyone is so upset and yelling "spyware". This information doesn't magically appear out of thin air or maybe I'm incorrectly assuming that tuaw readers have at least enough technical knowledge to know that there isn't really any other way to make this happen. Do you think your email appears from thin air too? How about your web browser? You go to a url, you get information that's displayed in your web browser... which is exactly what the ituned "spyware" does.
Oh, that's right. Most people aren't happy unless they are villifying someone. Foul play by Apple indeed!
Reply
djones said 2:29PM on 1-11-2006
mr.dave, that's the problem, and what constitutes it as spyware. It's done covertly. Do you know what and to whom the data is being transmitted? And what is the reasonable expectation. When you are shopping on Amazon, it's reasonably expected that Amazon will know what you're looking for, or it wouldn't be able to function. Same for the iTMS. The "other people purchased", or other ways of showing related offerings. Doing this from your music library is entirely different altogether. Do you reasonably expect that your musc playing software will be communicating to an online store? Are you also aware that the info is not just sent to the iTMS, but to a third party marketing data analytic company?
Inclusion in EULA aside, courts have demonstrated that that is neither sufficient to disclosure of transmission of private data, nor does it automatically make it legal because you had a user click that they agree. You couldn't, for an extreme example, put in your EULA that your company can now steal from you, or kill you with impunity. For our own protection from companies that do use these techniques maliciously, it is very important that legitimate companies such as Apple make a strong example of fully disclosing when, how, and to whom such data is sent, and give clear instructions on how to prevent it from occuring if the user doesn't want to.
Without that overt opt-out, it is spyware, regardless of it being benign.
Reply
Charles said 3:03PM on 1-11-2006
djones
There's nothing, read: NOTHING covert about this.
Do you know what and to whom the data is being transmitted?
Oh, shot in the dark here, I'd have to say... APPLE?!?
Doing this from your music library is entirely different altogether.
No, no friend it's not. And it's NO DIFFERENT than it used to work when clicking the arrow button to the right of a track in your library. Maybe YOU turned that off because you found it useless, but some of us consider it a useful feature. You know, because we don't like having to type in a band name for the same result.
Without that overt opt-out, it is spyware, regardless of it being benign.
OH MY GOD. You even conceed the op-out is obvious, plain in sight, AND that the feature and how it FUNCTIONS is in plain sight, and you STILL consider it spyware?
Reply
djones said 3:23PM on 1-11-2006
Charles, you can use all-caps all you want, but you still don't understand what you're saying.
Oh, shot in the dark here, I'd have to say... APPLE?!?
Wrong. Apple & Omniture. Not to mention, that's awful trusting of you to assume that it's only being sent to Apple. Because you assume that they wouldn't share this or open it to third-parties. Assumption is not disclosure. Simply tell me who, what, and why my data is being sent for the MiniStore, and it's a non-issue. If this software were made by some random shareware author, would you trust it's transmission? Or are you holding a double standard because all of us know that Apple (hopefully) would never do anything bad with our data?
And it's NO DIFFERENT than it used to work when clicking the arrow button to the right of a track in your library.
It's completely different. You are actively clicking on a link that takes you to the iTMS. In addition, the icon chosen to represent this action clearly indicates movement to an environment outside of your library. Not only does the information transmission happen without user initiation, but it's not clear whether or not this information is no longer transmitted when that window is turned off. TCP packet monitoring should not be required to see when, where, and to whom your data is being sent.
I love this feature; it's cool, it's useful. That makes it very easy to defend, and elicit comments from people about tin foil hats, etc. I encourage you to step back a moment from your narrow view of whether or not this example of spyware is harmful with it's potential effect on the ability of the justice department to carry out litigation against harmful transmission of your personal data without your explicit instigation. I guarantee you that unless Apple quickly makes a statement or update to 6.0.3 altering the level of disclosure, that we'll start seeing this software used as an establishment of precidence to defend some spyware marketing firms.
Reply
djones said 3:29PM on 1-11-2006
You even conceed the op-out is obvious, plain in sight, AND that the feature and how it FUNCTIONS is in plain sight, and you STILL consider it spyware?
Reading comprehension FTW, btw. I do not conceed that the op-out is obvious, but the exact opposite: that there is a complete lack of a clear opt-out.
Derek wrote: "...and give clear instructions on how to prevent it from occuring if the user doesn't want to. Without that overt opt-out..."
The only reason we even know that closing the MiniStore opts us out of the data transmission is because some net savvy individuals starting packet sniffing their output.
Reply
djones said 3:41PM on 1-11-2006
It'd be nice if some of the staff would finally speak on the issue of disappearing posts. *sigh*
Reply
djones said 3:43PM on 1-11-2006
(closing tag for italics about 3 posts ago.)
Reply
Charles said 3:45PM on 1-11-2006
I think you're the one who is trying to frame a non-issue in the confines of a narrow debate about privacy rights. Also, I use caps too much.
It's completely different. You are actively clicking on a link that takes you to the iTMS.
I dunno about you, but when I installed the application I was informed, in advanced, on apple's site about this new feature. Where's the lack of disclosure here?
In addition, the icon chosen to represent this action clearly indicates movement to an environment outside of your library.
Yeah, and exactly WHO could confuse the contents of the ministore as something OTHER than online content?
Not only does the information transmission happen without user initiation,
That's not true, they still clicked on the track, didn't they? "User Initiation". Maybe it wasn't apparent that would happen, but you know, informed users DO read about 'new features', even when they're right the fuck there on the website.
but it's not clear whether or not this information is no longer transmitted when that window is turned off.
Probably because it's pretty easily assumed. And yeah, I do hold Apple to different standards than say, your average spyware maker. I hold them to higher standards, and yes, that means I'll let little things slide, especially when I (informed citizen) know the difference between a feature and a soul-sucking privacy hole.
You know, you can probably turn anything into a battle over privacy rights... or you could choose your battles more wisely, like a DA would.
Reading comprehension FTW, btw.
Seriously, I misread your dangling clause there, but tell me, how much more overt can you get?
Reply