New in OS X: Get MacRumors Push Notifications on your Mac

Resubscribe Now Close

AccuWeather for iOS Sending Location Data to Monetization Company Even When Location Sharing is Off [Updated]

Popular and well-known iOS weather app AccuWeather has been caught collecting and sharing user location data even when location sharing permissions are turned off, according to a blog post recently shared by security researcher Will Strafach.

According to Strafach, AccuWeather was partnering with data monetization firm Reveal Mobile to collect GPS coordinates, including speed and altitude, the name and BSSID of a user's Wi-Fi router, and whether a device has Bluetooth on and off, all of which was available to Reveal Mobile when location services were enabled.


With location services disabled, AccuWeather was still sending the Wi-Fi router name and BSSID, which still offered Reveal Mobile location data.
During a testing period of 36 hours, specifically while the AccuWeather application was not in the foreground, my test iPhone (located on a desk in an office building) sent the above information to RevealMobile a total of 16 times, occuring roughly once every few hours.
Reval Mobile is a firm that uses location data to gather information on a user's home, work, and frequently visited locations, pairing that data with demographic targeting criteria to allow retailers to deliver targeted ads. From the company's website:
By expanding the use case of location data to pre- and post-shopping experiences, entirely new possibilities open up for online and offline retailers. The value lies in understanding the path of a consumer and where they go throughout the day. Traveling from home to work to retail to soccer practice to dinner is vital to knowing the customer, and represents the new opportunity of mobile location data.
In response to Strafach's blog post, Reveal Mobile says the data it collects is anonymized and grouped into audience segments. "We offer no product or service that permits anyone to see an individual device's location data," reads a statement on the Reveal Mobile website. The company also says it does not reverse engineer a device's location when location sharing is turned off.
We do not attempt to reverse engineer a device's location based upon other data signals like Bluetooth when location services are disabled. In looking at our current SDK's behavior, we see how that can be misconstrued. In response to that, we're releasing a new version of our SDK which will no longer send any data points which could be used to infer location when someone opts out of location sharing. We do collect IP address, but do not use this data to determine location, as covered in our privacy policy.
AccuWeather vice president of emerging platforms David Mitchell told ZDNet that AccuWeather will use data through Reveal Mobile for "audience segmentation and analysis, to build a greater audience understanding and create more contextually relevant and helpful experiences for users and for advertiser."

Following Strafach's discovery, many people have been uninstalling the AccuWeather app, and given the wealth of weather apps available in the App Store, this is not surprising. AccuWeather does not apparently have plans to end its relationship with Reveal Mobile, so users may want to find another weather app.

Update: AccuWeather and Reveal Mobile have provided a joint statement on the issue:
Despite stories to the contrary from sources not connected to the actual information, if a user opts out of location tracking on AccuWeather, no GPS coordinates are collected or passed without further opt-in permission from the user.

Other data, such as Wi-Fi network information that is not user information, was for a short period available on the Reveal SDK, but was unused by AccuWeather. In fact, AccuWeather was unaware the data was available to it. Accordingly, at no point was the data used by AccuWeather for any purpose.

AccuWeather and Reveal Mobile are committed to following the standards and best practices of the industry. We also recognize this is a quickly evolving field and what is best practice one day may change the next. Accordingly, we work to update our practices regularly.

To avoid any further misinterpretation, Reveal is updating its SDK and pushing out new versions of the SDK in the next 24 hours, with the iOS update going live tonight. The end result should be that zero data is transmitted back to Reveal Mobile when someone opts out of location sharing. In the meanwhile, AccuWeather had already disabled the SDK, pending that update.

Reveal has stated that the SDK could be misconstrued, and they assure that no reverse engineering of locations was ever conducted by any information they gathered, nor was that the intent.

AccuWeather will work with Reveal to restore the SDK when it has been amended and will continue to update its ULAs to be transparent and current with evolving standards. AccuWeather and Reveal continue to enhance methods for handling data and strive to provide superior, seamless, and secure user experiences.

We are grateful to have a supportive community that highlights areas where we can optimize and be more transparent.
Update 2: AccuWeather has updated its app to remove the Reveal Mobile SDK.



Top Rated Comments

(View all)

26 weeks ago
"The value lies in understanding the path of a consumer and where they go throughout the day."

no means no.
Rating: 72 Votes
26 weeks ago
Repeat after me: “if you don’t pay for the product, you ARE the product”
Rating: 50 Votes
26 weeks ago
Disgusting business practice. It's so difficult to find genuinely honest businesses these days..
Rating: 50 Votes
26 weeks ago

This was my go to weather app. Any suggestions for a replacement?

App store reviews are already getting hit hard.

Wunderground.
Rating: 24 Votes
26 weeks ago
Well, looks like Accuweather is getting deleted off my iDevices.
Rating: 23 Votes
26 weeks ago

AccuWeather does not apparently have plans to end its relationship with Reveal Mobile....


But we have plans for AccuTracker. Long press/click X.
Rating: 23 Votes
26 weeks ago

This was my go to weather app. Any suggestions for a replacement?

App store reviews are already getting hit hard.


Dark Sky! Predict weather exactly were you are (at what time is going to rain at your exact location, not the town... the street)
Rating: 12 Votes
26 weeks ago
They'll be burned at the stake for this. Violating privacy policies already enrages people but to then sell it too is just asking for death.
Rating: 11 Votes
26 weeks ago
I hope apple ban the app.. I would expect this type of behaviour to be against t&c and this is the one of the main reasons I buy Apple devices.
Rating: 9 Votes
26 weeks ago

Well, looks like Accuweather is getting deleted off my iDevices.


Deleted here, too. Not because I care about them having my location data, but because of their lacklustre response to this report. Shameful.
Rating: 9 Votes

[ Read All Comments ]