New App Store privacy rules could let Apple remove Facebook’s spyware-like Onavo VPN service

Chance Miller | Jun 12 2018 - 3:38 pm PT

Earlier today, a report emerged explaining how the App Store has explicitly banned developers from harvesting Contacts databases. Now, Bloomberg says this crackdown from Apple may hurt Facebook’s controversial “Protect” VPN service…

In February, Facebook started rolling out a new “Protect” feature to its iOS application. In the settings menu of the Facebook app, the “Protect” button linked to the Onavo Protect app in the iOS App Store. Facebook acquired Onavo in 2013.

While Facebook touted at the time that its Protect service gave users “peace of mind” and an “added layer of security,” it was quickly discovered that user data was being collected through Onavo and used to improve Facebook products and services:

To provide this layer of protection, Onavo uses a VPN to establish a secure connection to direct all of your network communications through Onavo’s servers. As part of this process, Onavo collects your mobile data traffic. This helps us improve and operate the Onavo service by analyzing your use of websites, apps and data. Because we’re part of Facebook, we also use this info to improve Facebook products and services, gain insights into the products and services people value, and build better experiences.

This evening’s Bloomberg report explains that Apple’s crackdown on harvesting user contact data cold be viewed as a direct response to Facebook’s practices through its Onavo Protect service. Protect uses a VPN to gather information about user devices, their location, what other apps are installed, how people use other apps, websites users visit, and the amount of data used.

As reported earlier today, Apple’s crackdown on App Store privacy bans applications that “collect information about which other apps are installed on a user’s device for the purposes of analytics or advertising/marketing.” This seems like it could be a very blatant and direct response to Facebook’s practice.

Bloomberg writes:

Apple’s new guidelines “sound like they’re almost written in response to what Onavo and others have been doing,” said Will Strafach, a researcher who has studied Onavo Protect and focuses on the security of Apple’s iOS mobile operating system. A Facebook spokeswoman declined to comment.

At this point, the Onavo Protect application is still available via the App Store and it’s unclear what steps Apple might take to remove it – or if Facebook will be given time to change its data collection practices through the app.