Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

Improper ‘shadow’ ads thriving on Facebook during India’s election

Bosses mandated them back to the office. They took legal action instead.

Election 2024 latest news: After big weekend in Palm Beach, Trump returns to N.Y. courtroom

Eddie Rosario and Co. lead the Nats to an MLB-best 12th comeback win

CJ Abrams keeps getting better. It’s time to think about an extension.

Sloppy first inning dooms the Nationals in a 6-3 loss to the Blue Jays

How did we end up with a Biden-Trump matchup again?

Under Putin, a militarized new Russia rises to challenge U.S. and the West 

Noem explains inclusion of story about shooting pet dog

How TikTok changed fashion

Book excerpt: The admiral who had a mental breakdown over Fat Leonard

How Pope Francis opened the Vatican to transgender sex workers

Historic floods kill 83, leaving Brazil and its president shaken, angry

Missing surfers from U.S., Australia confirmed dead by Mexico

We reported for months on changes sweeping Russia. Here’s what we found.  

Russia is using toxic chemical weapons, wrecking a ban it helped create

There’s still time for Congress to Trump-proof the Insurrection Act 

The Post endorses April McClain Delaney and Tom Royals for Maryland’s 6th District

Carolyn Hax: Sisters were close — then one accused the other’s husband of abuse

Miss Manners: I’m bothered by a fellow guest not touching their dessert

Ask Amy: My estranged wife is telling my son I’m an adulterer

Strangers help Sesame Street puppeteer after heirloom necklace was stolen

Teen grabs wheel when driver passes out and school bus veers into traffic

Cat climbed into Amazon return box, found alive 630 miles away

The Trump-Biden battle over the 2017 tax cut

That time football legend, rig-driving eligible bachelor Biden was arrested

Trump and allies say Biden pays rent for ‘illegals’ in Michigan. Not true.

Don’t be a jerk at the airport: A guide for headphones

The new cure-all for vacation excess: the IV drip 

What’s the best bus to New York? We tested 5 for comfort and value.

Trump’s vice presidential supplicants toe the line on election fraud

Kim Godwin steps down suddenly as president of ABC News

The ‘Access Hollywood’ video cemented Trump’s air of invincibility

The New York Times, alone in its outrage over access to Biden

WAUKESHA, WI - MAY 1st: Former president Donald Trump speaks at a campaign rally on Wednesday May 1st, 2024.  (Photo by Sara Stathas for the Washington Post)

Big Tech news and how to take control of your data and devices

See more coverage in your recommendations

Technology

Tips delivered to your inbox twice weekly

The Tech Friend newsletter

Business and Tech alerts

Washington Post Illustration; iStock

It’s 3 a.m. Do you know what your iPhone is doing?

Mine has been alarmingly busy. Even though the screen is off and I’m snoring, apps are beaming out lots of information about me to companies I’ve never heard of. Your iPhone probably is doing the same — and Apple could be doing more to stop it.

On a recent Monday night, a dozen marketing companies, research firms and other personal data guzzlers got reports from my iPhone. At 11:43 p.m., a company called Amplitude learned my phone number, email and exact location. At 3:58 a.m., another called Appboy got a digital fingerprint of my phone. At 6:25 a.m., a tracker called Demdex received a way to identify my phone and sent back a list of other trackers to pair up with.

And all night long, there was some startling behavior by a household name: Yelp. It was receiving a message that included my IP address -— once every five minutes.

What you can do to limit app tracking: 5 privacy tips

Our data has a secret life in many of the devices we use every day, from <a href="https://www.washingtonpost.com/technology/2019/05/06/alexa-has-been-eavesdropping-you-this-whole-time/?utm_term=.adaaa67e5b7d">talking Alexa speakers</a> to <a href="https://www.washingtonpost.com/news/the-switch/wp/2018/06/15/hands-off-my-data-15-more-default-privacy-settings-you-should-change-on-your-tv-cellphone-plan-linkedin-and-more/?utm_term=.ad4a09e04d65">smart TVs</a>. But we’ve got a giant blind spot when it comes to the data companies probing our phones.

You might assume you can count on Apple to sweat all the privacy details. After all, it <a href="https://www.washingtonpost.com/technology/2019/01/07/apple-burns-google-giant-billboard-touting-privacy-ces/?utm_term=.098a6ad77172" target="_blank">touted in a recent ad</a>, “What happens on your iPhone stays on your iPhone.” My investigation suggests otherwise.

IPhone apps I discovered tracking me by passing information to third parties — just while I was asleep — include Microsoft OneDrive, Intuit’s Mint, Nike, Spotify, The Washington Post and IBM’s the Weather Channel. One app, the crime-alert service Citizen, shared personally identifiable information in violation of its published privacy policy.

And your iPhone doesn’t only feed data trackers while you sleep. In a single week, I encountered over 5,400 trackers, mostly in apps, not including the incessant Yelp traffic. According to privacy firm <a href="https://disconnect.me/">Disconnect</a>, which helped test my iPhone, those unwanted trackers would have spewed out 1.5 gigabytes of data over the span of a month. That’s half of an entire basic wireless service plan from AT&amp;T.

Jhaan Elker

David Jorgenson

Geoffrey Fowler

“This is your data. Why should it even leave your phone? Why should it be collected by someone when you don’t know what they’re going to do with it?” says Patrick Jackson, a former National Security Agency researcher who is chief technology officer for Disconnect. He hooked my iPhone into special software so we could examine the traffic. “I know the value of data, and I don’t want mine in any hands where it doesn’t need to be,” he told me.

In a world of data brokers, Jackson is the data breaker. He developed an app called <a href="https://itunes.apple.com/us/app/disconnect-privacy-pro-entire/id1057771839?ls=1&mt=8">Privacy Pro</a> that identifies and blocks many trackers. If you’re a little bit techie, I recommend trying the free iOS version to glimpse the secret life of your iPhone.

Yes, trackers are a problem on phones running Google’s Android, too. Google <a href="https://disconnect.me/blog/update-android-app-is-still-banned-from-play-and-google-wont-talk-about-it">won’t even let Disconnect’s tracker-protection software</a> into its Play Store. (Google’s rules prohibit apps that might interfere with another app displaying ads.)

Help Desk: Ask our tech columnist a question

Part of Jackson’s objection to trackers is that many feed the personal data economy, used to target us for marketing and political messaging. Facebook’s fiascos have made us all more aware of how our data can be passed along, stolen and misused — but Cambridge Analytica was just the beginning.

Jackson’s biggest concern is transparency: If we don’t know where our data is going, how can we ever hope to keep it private?

James Cornsilk

App trackers are like the cookies on websites that slow load times, waste battery life and cause creepy ads to follow you around the Internet. Except in apps, there’s little notice trackers are lurking and you can’t choose a different browser to block them.

Why do trackers activate in the middle of the night? Some app makers have them call home at times the phone is plugged in, or think they won’t interfere with other functions. These late-night encounters happen on the iPhone if you have allowed “background app refresh,” which is Apple’s default.

With Yelp, the company says the behavior I uncovered wasn’t a tracker but rather an “unintended issue” that’s been acting like a tracker. Yelp thinks my discovery affects 1 percent of its iOS users, particularly those who’ve made reservations through Apple Maps. At best, it is shoddy software that sent Yelp data it didn’t need. At worst, Yelp was amassing a data trove that could be used to map people’s travels, even when they weren’t using its app.

A more typical example is DoorDash, the food-delivery service. Launch that app, and you’re sending data to nine third-party trackers — though you’d have no way to know it.

App makers often use trackers because they’re shortcuts to research or revenue. They run the gamut from innocuous to insidious. Some are like consultants that app makers pay to analyze what people tap on and look at. Other trackers pay the app makers, squeezing value out of our data to target ads.

Hands off my data! 15 default privacy settings you should change right now.

In the case of DoorDash, one tracker called Sift Science gets a fingerprint of your phone (device name, model, ad identifier and memory size) and even accelerometer motion data to help identify fraud. Three more trackers help DoorDash monitor app performance — including one called Segment that routes onward data including your delivery address, name, email and cell carrier.

DoorDash’s other five trackers, including Facebook and Google Ad Services, help it understand the effectiveness of its marketing. Their presence means Facebook and Google know every time you open DoorDash.

The delivery company tells me it doesn’t allow trackers to sell or share our data, which is great. But its <a href="https://www.doordash.com/privacy/">privacy policy</a> throws its hands up in the air: “DoorDash is not responsible for the privacy practices of these entities,” it says.

All but one of DoorDash’s nine trackers made Jackson’s <a href="https://github.com/disconnectme/disconnect-tracking-protection">naughty list</a> for Disconnect, which also <a href="https://disconnect.me/trackerprotection">powers the Firefox browser’s private browsing mode</a>. To him, any third party that collects and retains our data is suspect unless it also has pro-consumer privacy policies like limiting data retention time and anonymizing data.

Microsoft, Nike and the Weather Channel told me they were using the trackers I uncovered to improve performance. Mint, owned by Intuit, said it uses an Adobe marketing tracker to help figure out how to advertise to Mint users. The Post said its trackers were used to make sure ads work. Spotify pointed me to its privacy policy.

Privacy policies don’t necessarily provide protection. Citizen, the app for location-based crime reports, <a href="http://www.sp0n.com/citizen/privacy.html">published</a> that it wouldn’t share “your name or other personally identifying information.” Yet when I ran my test, I found it repeatedly sent my phone number, email and exact GPS coordinates to the tracker Amplitude.

After I contacted Citizen, it updated its app and removed the Amplitude tracker. (Amplitude, for its part, says data it collects for clients is kept private and not sold.)

“We will do a better job of making sure our privacy policy is clear about the specific types of data we share with providers like these,” Citizen spokesman J. Peter Donald said. “We do not sell user data. We never have and never will.”

The problem is, the more places personal data flies, the harder it becomes to hold companies accountable for bad behavior — including inevitable breaches.

As Jackson kept reminding me: “This is your data.”

David Becker

What disappoints me is that the data free-for-all I discovered is happening on an iPhone. Isn’t Apple supposed to be better at privacy?

“At Apple we do a great deal to help users keep their data private,” the company says in a statement. “Apple hardware and software are designed to provide advanced security and privacy at every level of the system.”

In some areas, Apple is ahead. Most of Apple’s own apps and services take care to either encrypt data or, even better, to not collect it in the first place. Apple offers a privacy setting called “Limit Ad Tracking” (sadly off by default) which makes it a little bit harder for companies to track you across apps, by way of a unique identifier for every iPhone.

And with iOS 12, Apple took shots at the data economy by improving the “intelligent tracking prevention” in its Safari web browser.

Alexa has been eavesdropping on you this whole time

Yet these days, we spend more time in apps. Apple is strict about requiring apps to get permission to access certain parts of the iPhone, including your camera, microphone, location, health information, photos and contacts. (You can check and change those permissions under privacy settings.) But Apple turns more of a blind eye to what apps do with data we provide them or they generate about us — witness the sorts of tracking I found by looking under the covers for a few days.

“For the data and services that apps create on their own, our App Store Guidelines require developers to have clearly posted privacy policies and to ask users for permission to collect data before doing so. When we learn that apps have not followed our Guidelines in these areas, we either make apps change their practice or keep those apps from being on the store,” Apple says.

Yet very few apps I found using third-party trackers disclosed the names of those companies or how they protect my data. And what good is burying this information in privacy policies, anyway? What we need is accountability.

Getting more deeply involved in app data practices is complicated for Apple. Today’s technology frequently is built on third-party services, so Apple couldn’t simply ban all connections to outside servers. And some companies are so big they don’t even need the help of outsiders to track us.

The result shouldn’t be to increase Apple’s power. “I would like to make sure they’re not stifling innovation,” says Andrés Arrieta, the director of consumer privacy engineering at the Electronic Frontier Foundation. If Apple becomes the Internet’s privacy police, it could shut down rivals.

Jackson suggests Apple could also add controls into iOS like the ones built into Privacy Pro to give everyone more visibility.

Or perhaps Apple could require apps to label when they’re using third-party trackers. If I opened the DoorDash app and saw nine tracker notices, it might make me think twice about using it.

Read more tech advice and analysis from Geoffrey A. Fowler:

<a href="https://www.washingtonpost.com/technology/2019/03/07/when-tax-prep-is-free-you-may-be-paying-with-your-privacy/?utm_term=.5ebf062cb8dd">When tax prep is free, you may be paying with your privacy</a>

<a href="https://www.washingtonpost.com/technology/2019/04/12/not-all-iphones-are-same-these-cost-less-are-better-earth/?utm_term=.859cc5c06417">Not all iPhones are the same. These cost less and are better for the Earth.</a>

<a href="https://www.washingtonpost.com/technology/2019/05/16/best-way-review-wireless-earbuds-is-have-sammy-hagar-headbang-with-them/?utm_term=.3f59d31f1134" target="_blank">Rock this way: AirPods, Beats and Bose wireless ear buds take the headbang test</a>

Want to learn about how to keep your personal information private? Check out our curated list of stories below.

<a href="https://www.washingtonpost.com/technology/2019/04/04/die-robocalls-die-how-to-guide-stop-spammers-exact-revenge/?utm_term=.4638a3df3341">Get smart about stopping spam calls</a>

Americans receive more than 5.2 billion automated calls in a month. But there are new apps to help stem the deluge. 

<a href="https://www.washingtonpost.com/technology/2019/05/28/its-middle-night-do-you-know-who-your-iphone-is-talking/?utm_term=.7f99305fd12c">Understanding what your phone tracks for marketers</a>

As tech columnist Geoffrey Fowler slept, a dozen marketing companies used his iPhone to learn his number, email, location and IP address.

<a href="https://www.washingtonpost.com/news/the-switch/wp/2018/06/01/hands-off-my-data-15-default-privacy-settings-you-should-change-right-now/">Say no to your default privacy settings</a>

Changing privacy default settings means you’ll get less personalization from some services, but it can slow down the number of eerie on-the-nose ads driven by data siphoned by major companies.

Gerald Loeb Award for commentary, 2020

Harvard University, B.A. in Anthropology and Afro-American Studies

Cambridge University, Trinity College, M.Phil in Social Anthropology

Geoffrey A. Fowler is The Washington Post’s technology columnist based in San Francisco. He joined The Post in 2017 after 16 years with the Wall Street Journal. He won the 2020 Gerald Loeb Award for commentary.