Safari Accessing Contacts/ App Privacy Report

[IW1206MT]

Since the release of the App Privacy Report, several forum users have noted that Safari is attempting to access Contacts. There is no explanation of why Safari would need this information, or what it is doing with the information accessed…..

Creating a separate thread to focus on this issue.

Observations:

Safari attempts to access contacts when:

-Navigating to duck duck go, google, bing, or a third party site that offers a ‘sign in with’ these services. Using the search bar in safari does not reliably trigger it… but navigating directly to the search site and entering a search does.

Once the page has written a cookie to the device (the user does not have to sign in…. Accessing www.google.com is enough….) subsequent visits do not generate another hit to contacts. I assume that eventually the cookie expires and the hit occurs again, though have not tested this.

If the site’s cookie is removed, the next visit will generate a hit to contacts. If all cookies are disabled in settings, every visit to the site will cause contacts to be accessed.

The following settings changes do not impact the behavior:

Safari—>Autofill On/Off

Siri—>Show when sharing On/Off (controls suggested contacts showing up in the share sheet)

Password autofill On/Off

User having an account with the search engine (or not) has no effect. (Safari hits contacts regardless)

Private browsing has no effect

Looking for suggestions on what info Safari needs from contacts/ observations from the community on the behavior. Essentially, is Safari providing any information to the search engines or other sites without express user permission?

 

[arunmv11]

I have the Same question. Privacy report shows that safari had accessed contacts. But in Settings > Privacy > Contacts safari is not even on the list.

 

[Saturn007]

Just discovered this issue and this thread on MR came up when I checked.

Safari and Photos access Contacts.

How do I turn that off?

Separate issue, perhaps, but lots of Google web addresses show up under domains most contacted, too. Yet, I don't use Google, but Duck, Duck, Go.

 

[Saturn007]

BUMP!

It's now June and it's still going on! iOS 15.5.

As the OP found, this happens even when all those settings mentioned are OFF!

Apple's Safari should not be rummaging through my Contacts without my permission.

The App Privacy Report is a welcome addition, but gives the lie to Apple's much vaunted protection of privacy!

No app or web site should be able to rummage one's info or contact a third party domain.

I even tested this switching from The Washington Post and New York Times apps to their web pages and ended up with just as much detritus and unwarranted external domain contacting and advertising cookies. It's outrageous, especially for subscribers.

Google's ad services (various ones) and Google analytics are the most ubiquitous offenders.

Apple needs to shut this down and the tech press needs to do a better job of exposing it.

 

[mor10mac]

The "Hide My Email" option seems to depend the "information from contacts" autofill option.

 

[papbot]

Anything that you use autofill for in Safari accesses your contacts. No mystery. But it’s fun to imagine your phone is spying on you for the Russians or Chinese

 

[Yusamac]

Anything that you use autofill for in Safari accesses your contacts. No mystery. But it’s fun to imagine your phone is spying on you for the Russians or Chinese

Bump. This answer is lacking. I tried turning off auto fill to fix this problem; it didn’t work. Bing is an example website that accesses your contacts every time you use it on safari even with auto fill off. Does anyone know how or why Bing is doing that? I’m not trying to say that anyone is spying on me; but it’s reasonable to assume that advertising websites (like search engines) are using the contacts app to automatically build a profile to serve better ads.
I really appreciate Apple’s efforts to show us exactly what information is coming and leaving our devices. If they didn’t put in that effort, people wouldn’t be able to keep there finger on this proverbial security pulse.

 

[papbot]

I’m curious about this because under Privacy - Contacts - only Hiya, a spam call blocker, can access my Contacts. I’ve turned on the App Privacy Report again to see what gets shown there over the next day. Other than for auto fill using your contact info I haven’t seen any Safari connection to my Contacts.

 

[papbot]

I left the Privacy Report on all day, checked the 7 day record and there was no Safari access of my Contacts. So no issues here, only Mail and Messages were shown as accessing Contacts.

 

[Yusamac]

I left the Privacy Report on all day, checked the 7 day record and there was no Safari access of my Contacts. So no issues here, only Mail and Messages were shown as accessing Contacts.

Oh wait, try turning ”private relay” on. That seems to affect it for me. Safari accesss contacts more with Private Relay on. I do not understand why.

 

[papbot]

I actually did turn that on for the first time a couple days ago, Safari has not accessed my Contacts. I thought it might have been because I turned that on.

 

[Yusamac]

I actually did turn that on for the first time a couple days ago, Safari has not accessed my Contacts. I thought it might have been because I turned that on.

That”s interesting…. Go to bing.com and look something up (I typed “hello”) and check again. That has repeatably made safari access contacts for me

 

[sorgo †]

Oh wait, try turning ”private relay” on. That seems to affect it for me. Safari accesss contacts more with Private Relay on. I do not understand why.

I have Private relay on and I’m seeing this issue on an iPhone running iOS 16. Safari has accessed my contacts every day of the past week; I use DuckDuckGo as my default search engine (and Google occasionally).

 

[papbot]

That”s interesting…. Go to bing.com and look something up (I typed “hello”) and check again. That has repeatably made safari access contacts for me

Went to Bing.com, looked up Texas football. Then checked the Privacy report, nothing accessed my Contacts. Only Maps and a weather app accessed my location. So no Safari issue in this regard. Private Relay is still on.

 

[psik]

Anything that you use autofill for in Safari accesses your contacts. No mystery. But it’s fun to imagine your phone is spying on you for the Russians or Chinese

Cause Americans and europeans don’t spy right? They are the master of spying and privacy breach- welcome as a new candidate, Csam

 

[thedr1]

Anything that you use autofill for in Safari accesses your contacts. No mystery. But it’s fun to imagine your phone is spying on you for the Russians or Chinese

As noted in OP, autofill is not relevant. But it's fun to imagine you can steer the conversation.

 

[thedr1]

All access Contacts: Messages, App Store, Apple Store, TestFlight, Home, Maps, Phone, Camera, Photos, Health, Watch, Calendar, Reminders, Fitness, Safari, Find My.

Messages, Phone, Find My: OK, reasonable (Find My _apparently_ accesses Contacts under People -> + -> Share My Location, which lists all Contacts who have iCloud accounts--sidebar, this is the only built-in way I know to get a tidy list of your Contacts who have iCloud accounts!!).

That leaves unaccounted Contacts access by: App Store, Apple Store, TestFlight, Home, Maps, Camera, Photos, Health, Watch, Calendar, Reminders, Fitness, Safari. (possibly other built-ins I've uninstalled or somehow incidentally disabled Contacts from accessing; I've not attempted to test this)

Clearly, Apple isn't trying to hide anything; they gave us the App Privacy Report tool to know! The most likely scenario is: these apps access Contacts for reason varying between, "subtle yet reasonable", to, "incidental and are best cleaned up". It's up to us to demand the accountability to discern which is which!

Finally, this isn't a super important issue in and of itself, yet worthy of SOME attention from Apple for three (3) reasons: 1) de-noise "App Privacy Report" DATA & SENSOR ACCESS so it can do it's job; 2) take the wind from the sails of naysayers; 3) worth auditing for re-design of Contacts API and/or internal usage of it.

 

[thedr1]

All access Contacts: Messages, App Store, Apple Store, TestFlight, Home, Maps, Phone, Camera, Photos, Health, Watch, Calendar, Reminders, Fitness, Safari, Find My.

Messages, Phone, Find My: OK, reasonable (Find My _apparently_ accesses Contacts under People -> + -> Share My Location, which lists all Contacts who have iCloud accounts--sidebar, this is the only built-in way I know to get a tidy list of your Contacts who have iCloud accounts!!).

That leaves unaccounted Contacts access by: App Store, Apple Store, TestFlight, Home, Maps, Camera, Photos, Health, Watch, Calendar, Reminders, Fitness, Safari. (possibly other built-ins I've uninstalled or somehow incidentally disabled Contacts from accessing; I've not attempted to test this)

Clearly, Apple isn't trying to hide anything; they gave us the App Privacy Report tool to know! The most likely scenario is: these apps access Contacts for reason varying between, "subtle yet reasonable", to, "incidental and are best cleaned up". It's up to us to demand the accountability to discern which is which!

Finally, this isn't a super important issue in and of itself, yet worthy of SOME attention from Apple for three (3) reasons: 1) de-noise "App Privacy Report" DATA & SENSOR ACCESS so it can do it's job; 2) take the wind from the sails of naysayers; 3) worth auditing for re-design of Contacts API and/or internal usage of it.

while Locations works the way I would want it to,
Contacts, Microphone, Photos, and Media Library all alike have the same problem. Contacts is most noticeable, being used by many apps.

The main reason I want to see all of this cleaned up: de-noise "App Privacy Report". ((Network Activity is hard enough to make sense of, but there may not be any easy answers.)) I think this can be cleaned up on Apple's side.