Update: The Electronic Frontier Foundation has withdrawn its post critical of AppFlash in light of additional information from Verizon. “As we said earlier this week, we are testing AppFlash to make app discovery better for consumers,” Kelly Crummey, Director of Verizon Corporate Communications, told the EFF. “The test is on a single phone – LG K20 V – and you have to opt-in to use the app. Or you can easily disable the app. Nobody is required to use it.”
How’s that for timing? Just days after Congress voted to repeal online privacy protections that would effectively give internet service providers (ISPs) the power to harvest your browsing data and sell it to the highest bidder, Verizon announced plans to install a service called AppFlash on subscribers’ devices that will track which apps they’ve downloaded.
AppFlash emerged from an existing app launcher and web search tool by a startup named Evie, which is also the name of the tool. After Evie debuted its eponymous launcher a few months back, the company teamed up with Verizon for AppFlash. The new app pops up whenever you swipe left on the home screen, and provides a search bar that parses preinstalled apps for restaurants, movies, music, and apps.
AppFlash searches the content within those apps, too — if you search for a TV show, you’ll see a list of services currently offering it. And it recommends apps using virtualization technology: You can stream up to a minute of an app from Evie’s servers free of charge.
But according to the Electronic Frontier Foundation (EFF), Evie’s true purpose is far more nefarious. When it begins to roll out to Android devices on Verizon’s network in the coming weeks, it will have the power to collect such information as your phone number, your phone’s serial number and operating system, the list of apps you’ve installed, your location, and your contact information. And it will use that information to target advertising on third-party websites.
“AppFlash information may be shared within the Verizon family of companies,” AppFlash’s privacy policy reads, “including companies like AOL, who may use it to help provide more relevant advertising within the AppFlash experiences and in other places.”
That means AppFlash could, in theory, target ads for formula and diapers to subscribers who’ve downloaded a fertility app. Folks who use the Narcotics Anonymous app could get pop-ups for pharmaceutical treatments. And there’s no end to the slippery slope from there.
AppFlash’s privacy policy implies the data collection is necessary for the app’s on-demand services to work — it can’t serve up local movie times, for example, without knowing your current location. But the EFF points out that it will provide a common target for hackers — it will be installed on most Android devices on Verizon’s network.
This is not the first time Verizon has drawn fire for its ad-tracking practices.
In 2012, under an initiative called Precision Market Insights, Verizon began selling information about subscribers’ geographical locations, app usage, and Web-browsing activities. It reserved the right to link that data to third-party databases with information about customers’ gender, age, and details such as “sports enthusiast, frequent diner, or pet owner.”
And in 2014, Verizon rolled out “supercookie” tracking technology that followed users’ browsing histories. It created a permanent profile of habits, likes, and interests that couldn’t be deleted, even if subscribers used a private browsing mode or selected “Do Not Track” in their settings.
“We’re able to view just everything that they do,” Bill Diggins, U.S. chief for Verizon Wireless marketing, said at an industry conference. “And that’s really where data is going today. Data is the new oil.”
FlashApp has yet to roll out. But when it does, you can bet on a long, protracted battle between Verizon, its subscribers, and privacy advocates.
Updated on 03-31-2017: Added statement from Verizon.
