How Pandora and other smart phone apps may be spying on you

Federal prosecutors may be investigating if smart phone apps, such as the popular Pandora music streaming program, are invading consumers privacy. But just what kind of information can these apps glean from your smart phone and share without your knowledge?

Computer software security firm Veracode took at look at the code for the app for Pandora—one of the supposed targets of the federal investigation, as reported by the Wall Street Journal earlier this week. And Veracode's analysis indicates that the type of data—and how it is obtained—is rather detailed.

The company found software code that ties the app to five online ad companies: AdMarvel, AdMob, comScore (SecureStudies), Google.Ads, and Medialets. And those parts of the Pandora app code, the "ad libraries," are designed to routinely assess a smart phone's status: geographic location, connection to the wireless net and what software is running.

Veracode says on its own blog about the analysis:

In isolation some of this data is uninteresting, but when compiled into a single unifying picture, it can provide significant insight into a person's life. Consider for a moment that your current location is being tracked while you are at your home, office, or significant other's house. Couple that with your gender and age and then with your geolocated IP address. When all that is placed into a single basket, it's pretty easy to determine who someone is, what they do for a living, who they associate with, and any number of other traits about them.

What's more, all this data may be gathered all without the app user's—or Pandora's—knowledge. Writes Veracode:

The application developers may not even be aware of the privacy violations they are introducing by using third party advertising libraries. They may merely think they are getting $x per ad impression, not that the ad library is leaking significant information about the user.

And that may be the reason why federal prosecutors are taking a closer look at smart phone apps. Just who is aware of what types of personal data are being collected by mobile apps and when and how are such private info being shared?

If you're concerned about protecting your privacy, check out Consumer Reports Guide to Online Security for safety tips.

Mobile Apps Invading Your Privacy [Veracode's blog]
Mobile-App Makers Face U.S. Privacy Investigation [Wall Street Journal]

—Paul Eng