A new class-action lawsuit is attacking Apple on a different front, alleging that Apple has misled customers by not disclosing that Apple actually uses third-party cloud providers to store iCloud data, rather than its own servers.
According to ZDNet, a pair of Apple customers this week filed a class action complaint against Apple for failing to disclose these storage practices. According to the complaint, Apple is guilty of breach of contract, false advertising, and violating California’s Unfair Competition Law.
Behind the complaint is the fact that the terms of service that Apple presents states that “When iCloud is enabled, your content will be automatically sent to and stored by Apple.” In reality, however, Apple uses a number of third-party storage providers to handle iCloud data, including Amazon Web Services and Google Cloud Platform.
The suit, which was filed on behalf of Florida resident Andrea M. Williams and California resident James Stewart in the U.S. District Court for the Northern District of California, states that “The selection of a cloud storage provider is a significant and material consideration, as it involves entrusting all of a user’s stored data — including sensitive information like photographs, documents of all kinds, and e-mail content.” Therefore, the plaintiffs argue that users should be informed about who is “offering this storage and taking custody of their data.”
Although Apple acknowledges in its iOS Security Guide that it does in fact use these services, the complaint hinges on the fact that this isn’t disclosed in the actual contract with end users signing up for iCloud itself, who are unlikely to read a security guide targeted primarily at technology professionals.
Everything is Encrypted
However, Apple also explicitly points out that all of the data stored on these services is completely encrypted and anonymized:
The encrypted chunks of the file are stored, without any user-identifying information or the keys, using both Apple and third-party storage services— such as Amazon Web Services or Google Cloud Platform—but these partners don’t have the keys to decrypt your data stored on their servers.iOS Security Guide
While the lawsuit concedes this point, it says this only addresses “some” of the privacy concerns involved, but that it “does nothing to address other fundamental concerns about the integrity of the data.”
In other words, the plaintiffs are suggesting that this isn’t just about keeping users’ data private, but also keeping it safe from being lost or destroyed by these third-party storage providers.
An ‘Apple Premium’
The lawsuit also charges that Apple is engaging in unfair business practices by charging the “Apple premium” for its iCloud services, trading on the trust and value that customers place in the Apple brand, and implying that it would not be able to win as many customers or charge such high rates if it fully disclosed that it was actually using the same third-party storage as many other cloud services rather than it’s own data centres.
For Apple’s part, it’s planning to invest more than $10 billion to build more data centres in the U.S., but it’s also unclear how much data in iCloud storage is actually hosted on third-party servers, or what the nature of that data is, although this will presumably be revealed as part of the normal legal disclosure proceedings should the case move on to the next stage.
For now, the plaintiffs are requesting a class action on behalf of all Apple customers in the U.S. who paid for an iCloud subscription at any time from August 20, 2015, to the present.