New in OS X: Get MacRumors Push Notifications on your Mac

Resubscribe Now Close

Privacy Advocates and Devs Raise Concerns About Third-Party App Access to TrueDepth Camera

Apple goes into great detail about the security of the Face ID facial recognition system built into the iPhone X in a security white paper and a support document, but relatively little has been said about the access that developers have to facial data captured by the TrueDepth camera, which has led privacy advocates and developers to express concerns about what apps can glean about you from your face.

A new piece from The Washington Post that includes commentary from both privacy experts and Apple itself explores the data third-party apps can access, echoing concerns previously brought up earlier this month.


Apps have no access to the facial map that Face ID uses to unlock your device, but developers are able to use the TrueDepth camera to scan a user's face for the purpose of creating more realistic augmented reality apps. As described by Apple:
Using the TrueDepth camera, your app can detect the position, topology, and expression of the user's face, all with high accuracy and in real time, making it easy to apply live selfie effects or use facial expressions to drive a 3D character.
Apps are able to see a full 3D face map along with a "live read-out" of 52 micro-movements in the eyelids, mouth, and other features. MeasureKit, a free app developed by Rinat Khanov, has a face mesh tool built in that displays the facial data the TrueDepth camera can capture along with a list of the facial expressions it tracks.


Apple has a privacy policy that's been in place since before the iPhone X launched requiring apps that use the TrueDepth camera to have a privacy policy, secure user consent option, and a clear outline of what data is being collected and how it's used, but The Washington Post's Geoffrey Fowler worries about the future implications of the TrueDepth camera, where such facial data could perhaps be used to determine gender, race, sexuality, or track facial expressions to determine medical conditions like depression.

"We take privacy and security very seriously," Apple spokesman Tom Neumayr said. "This commitment is reflected in the strong protections we have built around Face ID data--protecting it with the Secure Enclave in iPhone X--as well as many other technical safeguards we have built into iOS."

Khanov, the developer behind the aforementioned MeasureKit app, says Apple's policies may not be enough. Khanov didn't initially have a privacy policy in place in his app, and it was approved anyway. Apple said it was an oversight and asked Khanov to implement a privacy policy right away.
"There were no additional terms or contracts. The app review process is quite regular as well--or at least it appears to be, on our end," Khanov said. When I noticed his app didn't have a privacy policy, Khanov said Apple didn't require it because he wasn't taking face data off the phone.
As Fowler points out, apps that are using the TrueDepth camera are not currently providing enough information to customers. The popup to access the TrueDepth camera is the same generic popup that is required for the standard front and rear-facing cameras, and it does not mention that additional data is being collected.

Whether Apple will put stricter policies in place remains to be seen, as does how this kind of facial recognition data will be used in the future, but customers should be made aware of what's being provided to app developers. For those concerned, it's worth downloading the MeasureKit app or a similar app to see what's potentially being collected when an app accesses the camera on your iPhone X.

Related Roundup: iPhone X
Buyer's Guide: iPhone X (Buy Now)


Top Rated Comments

(View all)

12 weeks ago
In the meanwhile, silently, Facebook and Google store informations about billions of users down to the disposition of their pubic hair.
Rating: 28 Votes
12 weeks ago
As the de facto industry leader, it will be interesting to see how Apple deals with these questions. Insurance and marketing companies love learning more about how we behave and what we look like (color of skin, attractiveness, propensity to smile, state of teeth etc). Unfortunately, the consequences likely won't be good for the large majority of people out there who will be profiled and sorted into risk classes.
Rating: 15 Votes
12 weeks ago
As soon as they require you to look at the phone to continue playing an ad.... my iPhone X goes on eBay.
Rating: 15 Votes
12 weeks ago
"We take privacy and security very seriously," Apple spokesman Tom Neumayr said. "This commitment is reflected in the strong protections we have built around Face ID data--protecting it with the Secure Enclave in iPhone X--as well as many other technical safeguards we have built into iOS."

What a bunch of legal double talk. I'm sure when Equifax was hacked they also said they took security seriously while over 100 million people's sensitive financial information was released into the dark web.

Bottom line, more and more companies today have our personal data and when they are hacked, they just say we are sorry, but we did take security seriously.
Rating: 12 Votes
12 weeks ago
I'm sure in 5 years we'll be reading some report that X company got special API access to FaceID APIs directly from Apple and X company stored user face scans on their servers.

Just like how Apple gave special API access to Uber for the Apple Watch, which allowed Uber to infringe upon user privacy.
Rating: 11 Votes
12 weeks ago

Don't like it buy another phone. I am tired of privacy advocates (otherwise known as tech averse idiots) dictating what I can and cannot do.


Hey, you can be a tech lover and a privacy lover too. The two things are not mutally exclusive. Have you heard of something called encryption for example? :rolleyes:

What exactly have these so-called ‘idiots’ stopped you doing exactly? I don’t think anyone really wants to stop letting you trade your privacy to people/apps/companies if you want to, this is about consent and choice. If an app wants to gather and keep data from a user, the user should be aware of that, the reasons why, and be able to make an informed choice as to whether they want to go ahead or not.

It’s about enabling choice for users, not stopping you doing anything. And it’s about users being able to decide where they want the balance to be drawn between privacy and certain kinds of functionality that require giving up some of that privacy. It isn’t a black and white ‘total privacy vs zero privacy’ zero-sum game.
Rating: 9 Votes
12 weeks ago
OMG people, please lighten up. FaceID has got to be the best feature I've seen in a phone yet. Being able to lift it and it unlocks w/o intervention is frickin' amazing IMO. All my apps that used to use TouchID now are using the FaceID and it's, again, frickin' amazing! I am so pleased with this phone. Hands down it's the best phone I have ever owned. Period.
Rating: 8 Votes
12 weeks ago

Don't like it buy another phone. I am tired of privacy advocates (otherwise known as tech averse idiots) dictating what I can and cannot do.

The strongest privacy advocates I know are also technically brilliant. When you know the tech, you have a clearer view of the risks that accompany the benefits-- and also know that there are often ways to achieve the same goals while preserving privacy.
Rating: 6 Votes
12 weeks ago
And no one will read the disclaimers...
Rating: 6 Votes
12 weeks ago
Hundreds of apps go through approval each day, some will sneak through.
Rating: 5 Votes

[ Read All Comments ]