Accuweather found to be sharing location data without users’ permission
Wed 23 Aug 2017
Accuweather has been found to be sending location data even when the user has turned off location sharing.
The weather app, one of the most popular for iOS, ostensibly collects location data in order to be able to send users localised weather reports and updates.
When doing so, it also sends some information to a company called Reveal Mobile, according to a security blogger Will Strafach. Reveal Mobile states that it ‘helps app publishers and media companies extract the maximum value from their location data.’
Strafach found that Accuweather sends precise GPS coordinates, including current speed and altitude, the name and BSSID (Basic Service Set ID) of the WiFi router the user is connected to, which can be used for geolocation, and whether or not the device has Bluetooth turned on.
He also found that across a 36-hour test period, while Accuweather was not in the foreground on his iPhone, this information was sent 16 times, a rate of just under once every two hours.
Reveal Mobile states on its website that it can use location data to improve targeted advertisements for businesses. It says: ‘Location data also informs the home and work location of customers. Pairing this information with existing demographic targeting criteria allows retailers to target consumers with a high propensity to visit.’
ZDNet independently verified the claims, finding that when location services were turned off, a user’s location could be found within a few metres, and to an even more precise level when location services are switched on.
An Accuweather executive commented: ‘In the future, AccuWeather plans to use data through Reveal Mobile for audience segmentation and analysis, to build a greater audience understanding and create more contextually relevant and helpful experiences for users and for advertisers.’
However, Strafach noted that although Accuweather’s privacy policy may use geolocation services, it does not state that these will be used for advertising or monetisation purposes.
Speaking to ZDNet, Strafach said: ‘AccuWeather get GPS access under an entirely innocent premise – no users expect the location data to be used this way.’
