Was this done with malicious intent, in order to gain access to private data? Possibly not, according to Path this was to help people connect with others with Path accounts, and to notify them when someone they knew joined the network. However the privacy implication of this can be rather severe. The information was obviously very private, and the application did not even ask the user for basic permission before not only accessing it, but posting it to their own server. For the application developer this was a great feature, but for the consumer this was unwanted—even if unintended—intrusion of their privacy.
Of course there are always applications that take deliberate advantage of the people using them. For example, there are a not insignificant number of applications that take advantage of parents though their children. Such apps come for free and offer a fun experience for children, but to their parents’ dismay they require a constant stream of micro-payments in order to be enjoyed. Parents needs to be aware of these as well.
The answer lies, according to the report, in more transparency. An application needs to declare not only what permissions it needs, but also why it needs them. The report calls on developers to follow three key principles:
- Applications should adopt a privacy-by-design approach that minimizes risks to personal information.
- Applications should provide consumers with simpler and more streamlined choices about relevant data practices.
- Applications should provide consumers with greater transparency about how data is collected, used, and shared.
Parents need all the information they can get. If an application uses geolocation, they should know that it does, and as importantly why. If an application has in-app purchases, parents should know that, so that the “free” app they buy instead of that $2 app doesn’t end up costing them hundreds of times more.
