Apple says it now requires a judge’s consent before it will hand over your push notification data to law enforcement or government officials, according to an update of Apple’s Legal Process Guidelines on Tuesday. Senator Ron Wyden wrote a letter to the Department of Justice last week accusing foreign governments of spying on Americans through push notification data.
Senator Wyden says Apple was “doing the right thing by matching Google and requiring a court order to hand over push notification-related data,” in a statement to Reuters Tuesday.
Wyden’s letter alleged foreign governments were demanding metadata about American users’ push notifications. This metadata flows through Google and Apple’s servers and could be used by law enforcement to expose the true identities of anonymous online users.
Apple’s new section, titled Apply Push Notification Service (APN), first appeared the day Senator Wyden sent his letter (Dec. 6), but not in previous versions of Apple’s Legal Process Guidelines (Nov. 29). The section clarifies that when you allow applications to send you push notifications, an APN token is registered to your device. If a government wants information to associate an APN token with your Apple ID, those “records may be obtained with an order under 18 USC 3703(d) or a search warrant.” Both of these provisions require a judge’s consent to hand over this data but call into question how easy it was for law enforcement to access it in the past.
As Wyden calls out in his statement today, Apple’s update matches Google’s language in its Privacy and Terms, which also requires a subpoena or court order to hand over metadata about users. Google was the first to publish a transparency report detailing how many government requests the company receives for disclosing user information.
In the last six months of 2022, Google received over 192,000 requests from government officials around the world to disclose user information. The Android phone maker disclosed information in 79% of them. Apple also provides a transparency report. Germany requested the most user information in the first half of 2022 with requests for nearly 12,000 devices.