Developer Alert: Airpush now collects and sells your users’ personal data

Note: Airpush’s CEO response in comments about actual consent practices and pending policy revision.

On Monday, mobile ad network Airpush, which calls itself the “second largest mobile ad network,” revised their privacy statement in a major way. Now they state that they may collect personal data about your users, and reserve the right to share it with any marketer. This should be of great concern to the major brands that Airpush claims as customers, including BestBuy, Fandango and Hotels.com.

Airpush now explains that they can grab any data that your app has permission to use, including personal data (emphasis mine):

Airpush’s Service enables mobile application developers to provide free, ad-supported applications to end users.  When you download a mobile application that utilizes our Service, we may collect information from your mobile device in accordance with the permissions you have granted when installing the application.  For example, in accordance with the permissions you have granted, we may collect your device ID, device make and model, device IP address, mobile web browser type and version, mobile carrier, real-time location information, email address, phone number and a list of the mobile applications on your device.

Then they explain that there no longer any real limits on sharing it:

Disclosure of Data Collected through Our Service – We may share personal information about you as follows:

- with third party advertisers who are part of the Airpush mobile advertising platform for their direct marketing purposes …

Recommendation: Remove Airpush from your apps, unless you are prepared to provide a prominent notice to your users at that their personal data is now available to any marketer. If you keep Airpush installed, you will need to notify all of your users of this change in the rules.

Lesson: The privacy framework of your app is no better than the privacy framework of the companies that you allow to collect data about your users. Make sure you scan your apps so you know which companies are collecting data, and make sure you check their qualifications and policies.

Learn more >>

This entry was posted in mobile, Outliers, Privacy Policies, Pros. Bookmark the permalink.

11 Responses to Developer Alert: Airpush now collects and sells your users’ personal data

  1. Pingback: Quora

  2. asher delug says:

    Hi Jim, I’m the CEO of Airpush. You are missing out some extremely important information here and I hope you can update the article as such:

    1) We go beyond the “prominent notice” you recommend, and in fact require a full OPT-IN. Users must fully opt-in to our data collection and privacy policies. When you launch an app with Airpush for the first time, it gives a full-screen opt-in disclosure and users must affirmatively click I Agree. It is a very short and direct opt-in written by our attorneys.

    2) We are using PII in the EXACT same way which both Google, Pontiflex, and others are using it. The data is not stored on our servers, and is simply passed to the advertiser landing page so that the information can be pre-populated at the user’s convenience. The user can easily edit or remove the info before submitting the form.

    • Jim Brock says:

      Thanks for your comment, this kind of dialogue is very important and I appreciate your attention to the issue.

      Are you saying that in every case you solicit from end users their express consent to share “device ID, device make and model, device IP address, mobile web browser type and version, mobile carrier, real-time location information, email address, phone number and a list of the mobile applications on your device”?

      If you do receive this consent in each case, then the policy is over-broad. As amended, the policy allows you to receive this data indirectly via the app and share it. Because apps have greater access to personal data than your service may directly have, this exposes users to greater risk. Since that is not your intention, end-users would be best served by more specific and limited language.

  3. asher delug says:

    Hi Jim, I appreciate the response. Yes, in fact we get express consent via our opt-in screen which also links to our privacy policy.

    I frankly agree with your analysis that the privacy policy can be improved to better reflect our actual usage — for example the opt-in requirement, expressly stating that we don’t store the data, and other items.

    I have reached out to our attorneys so they can take another look – thank you. If possible, I would much appreciate if you could update the article to reflect our confirmation that we receive express user consent and do not store or sell data. The data is simply being used for end-user convenience to pre-populate a form, in the same manner that Google, Pontiflex, and others use the method.

  4. Aminul Islam says:

    I really liked this conversation. Specially the replies. Yes, airpush policy is not well written and misleading. Please do something on that. Thanks.

  5. Barry Rabovskie says:

    As a mobile app developer who is very well read on mobile privacy and mobile security, I cannot for the life of me understand why Airpush is a punching bag for critics who really don’t understand what Airpush is about and how responsible it actually is. I guess there has to be a “big bad wolf” out there for someone to write about. But the selection of Airpush as this villainous fixture of the mobile ad world is unfounded. Airpush does, in fact, require a full OPT-IN. I don’t know how much more clear you can be than with a full-screen opt-in disclosure that requires an “I Agree” from the user. As the company ceo said above, Airpush uses PII just as both Google and other prominent names are using it. So I think it’s important that we get the facts straight and not go on a witch hunt where there is no threat. There are REAL and HORRIBLE threats, people, and platforms that mobile devs, advertisers, and subscribers should worry about. Airpush is NOT one of them. Good grief!

    • Jim Brock says:

      The point of the post is that Airpush changed their policy in a way that allows them to share personal data. If they aren’t doing that, the policy doesn’t need to allow it, which is why they have noted that they are changing their policy.

  6. Kairat says:

    You may like it or not. Airpush is the future mob. ad. network.
    All the other networks will use the same advertising tech. soon.

  7. James says:

    Thank you for this post. I was planning to implement Airpush to my application, but this changed my mind.

  8. Javier says:

    Well i would really like to use Airpush in our apps, but the simple fact that Airpush can collect such datas from our users, and sell it to third parties prevents us definitely to use this ad service. It’s simply a question of respect for our users, that’s it…

  9. Seth says:

    Asher,

    That is complete hogwash. Even if you select cancel, that opt in screen keeps popping up continuously. Ruining the entire experience for any app. That opt out screen? Even worse.

    I hope you realise that by ruining the app experience, you’re setting yourself up for failure.

    Regards

Leave a Reply

Your email address will not be published. Required fields are marked *

*

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>