AccuWeather for iOS Sending Location Data to Monetization Company Even When Location Sharing is Off

Popular and well-known iOS weather app AccuWeather has been caught collecting and sharing user location data even when location sharing permissions are turned off, according to a blog post recently shared by security researcher Will Strafach.

According to Strafach, AccuWeather was partnering with data monetization firm Reveal Mobile to collect GPS coordinates, including speed and altitude, the name and BSSID of a user's Wi-Fi router, and whether a device has Bluetooth on and off, all of which was available to Reveal Mobile when location services were enabled.


With location services disabled, AccuWeather was still sending the Wi-Fi router name and BSSID, which still offered Reveal Mobile location data.
During a testing period of 36 hours, specifically while the AccuWeather application was not in the foreground, my test iPhone (located on a desk in an office building) sent the above information to RevealMobile a total of 16 times, occuring roughly once every few hours.
Reval Mobile is a firm that uses location data to gather information on a user's home, work, and frequently visited locations, pairing that data with demographic targeting criteria to allow retailers to deliver targeted ads. From the company's website:
By expanding the use case of location data to pre- and post-shopping experiences, entirely new possibilities open up for online and offline retailers. The value lies in understanding the path of a consumer and where they go throughout the day. Traveling from home to work to retail to soccer practice to dinner is vital to knowing the customer, and represents the new opportunity of mobile location data.
In response to Strafach's blog post, Reveal Mobile says the data it collects is anonymized and grouped into audience segments. "We offer no product or service that permits anyone to see an individual device's location data," reads a statement on the Reveal Mobile website. The company also says it does not reverse engineer a device's location when location sharing is turned off.
We do not attempt to reverse engineer a device's location based upon other data signals like Bluetooth when location services are disabled. In looking at our current SDK's behavior, we see how that can be misconstrued. In response to that, we're releasing a new version of our SDK which will no longer send any data points which could be used to infer location when someone opts out of location sharing. We do collect IP address, but do not use this data to determine location, as covered in our privacy policy.
AccuWeather vice president of emerging platforms David Mitchell told ZDNet that AccuWeather will use data through Reveal Mobile for "audience segmentation and analysis, to build a greater audience understanding and create more contextually relevant and helpful experiences for users and for advertiser."

Following Strafach's discovery, many people have been uninstalling the AccuWeather app, and given the wealth of weather apps available in the App Store, this is not surprising. AccuWeather does not apparently have plans to end its relationship with Reveal Mobile, so users may want to find another weather app.


Discuss this article in our forums