发表机构
Trinity College Dublin（都柏林三一学院）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
研究发现苹果应用商店在用户未同意且无退出选项的情况下，收集并传输大量非必要的Cookie、广告跟踪标识及GDPR特殊类别数据，用于广告定向，侵犯用户隐私。
AI 中文摘要
我们分析了苹果应用商店向苹果服务器发送及从苹果服务器接收的数据。我们发现，苹果服务器会发送多个Cookie并存储在手机上。带有跟踪标识符的广告也存储在手机上，并且我们观察到，苹果服务器使用GDPR特殊类别个人数据（如性取向、宗教信仰和健康状况）来选择广告。用户与苹果应用商店的交互（查看的应用和广告、点击的按钮、进行的搜索等）会与将这些数据关联到个人用户和设备的标识符一起传输给苹果服务器。我们表明，这些数据存储和传输中的大部分对于用户所请求的服务（即查看、搜索和安装应用）并非必需。对于所有这些数据存储和处理，未征求任何同意，也没有退出选项。
英文摘要
We analyse the data that the Apple App Store sends to and receives from Apple servers. We find that multiple cookies are sent by Apple servers and stored on the handset. Adverts with tracking identifiers are also stored on the handset, and we observe that adverts are selected by Apple servers using GDPR special category personal data such as sexuality, religious beliefs and health. User interactions with the Apple App Store (apps and adverts viewed, buttons clicked, searches made etc) are transmitted to Apple servers alongside identifiers linking this data to the individual user and device. We show that much of this data storage and transmission is not essential for the service requested by the user, namely to view, search and install apps. No consent is sought for any of this data storage and processing, and there is no opt out.
