Apple revoked Google’s ability to publish iPhone and iPad software outside its iOS App Store following a similar move against Facebook earlier this month.
Google had been using a special type of company-wide credential called an enterprise certificate, which enabled it to install apps via its own channels without offering them in the App Store. The company used it to install an app called Screenwise Meter on consumer devices.
Offered on a voluntary basis to people as young as 13 years old as part of a family group, Screenwise Meter offered gift cards in return for letting Google see the user’s usage and app data. The app operated under Google’s Opinion Rewards program, which collected information about what users watched and how they used the internet to help refine Google products.
Apple offers the enterprise certificate under its Enterprise Developer program, enabling companies to develop proprietary applications that they can distribute outside the iOS App Store.
In its terms and conditions, Apple explained that this type of certificate is not intended for consumer-facing apps. A legitimate use case would be for apps targeting a company’s employees. This means that Google had been violating the rules by using it to distribute Screenwise Meter.
Screenwise Meter would likely not have passed the privacy policy for the iOS App Store, which Apple updated in the summer with stricter rules around the collection of personal data.
Neither would the Facebook Research App, a piece of software that Facebook was found distributing to consumers under an enterprise certificate. The company paid users up to $20 a month to slurp their internet usage information via the app.
Although Facebook voluntarily took down the app, Apple pulled its enterprise certificates after hearing about it, effectively nixing the company’s ability to distribute apps outside the App Store. However, on the same day that it did the same to Google, it reinstated Facebook’s certificates.
The topic of Data Protection will be covered throughout the free-to-attend conference at Infosecurity Europe in London from 4-6 June. See all the talks on Data Protection here. Infosecurity Europe is the leading European event for information and cyber security; find out more and secure your free visitor badge.
