US/International Law regarding collection of diagnostic data from iPhone app
<p>I am designing an iPhone ultrasound transceiver. </p>

<p>In order to improve the algorithm I wish to send an occasional ~2-3s chunk of audio containing the signal to my server.</p>

<p>As such, this would clearly be illegal, as it could catch fragments of spoken content.</p>

<p>However I only need the frequency data from a narrow (17-19kHz) band.</p>

<p><a href="https://i.stack.imgur.com/R7xhh.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/R7xhh.png" alt="enter image description here"></a></p>

<p>Here is a spectrogram of my saying 'Quick brown fox jumps over the lazy dog' with the frequency band highlighted.</p>

<p>As a DSP/ML engineer I can see no realistic means of reconstructing what was spoken from the content of this band. Vowels are indistinguishable at best (having formants &lt; 10kHz).  <code>fff</code> and <code>sss</code> type sounds do occasionally make it that far up the spectrum.</p>

<p>Potentilly, theoretically, a super-advanced algorithm in the future may be able to identify certain phonemes, and provide plausible reconstructions of what might have been spoken based on their time-spacing. Potentially it may be able to identify a certain speaker.</p>

<p>Currently I am planning to ask users if they wish to send diagnostic data, Which eliminates the risk. However it does so at the expense of aggravating users by instilling worry and forcing an extra yes/no decision. It is not good for user experience, and also not good for data collection as many will elect NO.</p>

<p>What is my liability / risk of consequence if I <em>don't</em> ask?</p>

<p>I feel 90% sure I need to ask, but I would like to reality check.</p>

<p>PS Currently this is a US product, however it will expand internationally.</p>

<p>Read Apple's ( <a href="https://developer.apple.com/app-store/review/guidelines/#data-use-and-sharing" rel="nofollow noreferrer">https://developer.apple.com/app-store/review/guidelines/#data-use-and-sharing</a> ) or Google's ( <a href="https://play.google.com/about/privacy-security-deception/" rel="nofollow noreferrer">https://play.google.com/about/privacy-security-deception/</a> ) App store TOS and privacy policies on Apps; if you submit an App that does not comply with their rules regarding privacy and disclosure of data collection, they simply won't accept it.</p>

<blockquote>
  <p><em>"What is my liability / risk of consequence if I don't ask?"</em></p>
</blockquote>

<p>1) When your App is discovered to return data to you - either by a user who investigated after their security App flagged your App, or by the App store/site itself that runs security checks on Apps before allowing them in the store - it gets removed from App stores/sites because of the lack of disclosure in your App's Privacy Policy/TOS of transmitting what could be seen private data. I'm not saying the data could be reconstructed into speech that could be understood, i.e., your points above; but it is data that the user was not allowed to opt-out of or was advised about in your App's Privacy Policy/TOS.</p>

<p>2) You get sued by one or more users who discover that your App returns data when your App's Privacy Policy/TOS does not account for or disclose the data collection. Your defense in court that the data doesn't reveal personal information won't be of much use, because the lawsuit will be about the data collection in principle and the fact that it is not outlined or disclosed in your App's Privacy Policy/TOS.</p>

<p><em>(Jurisdiction comes into play; this is mostly for the US. Look into the GDPR for the EU.)</em></p>

privacy data-protection