Podcast apps, privacy, and GDPR

When you listen to a podcast, just like anyone else, you’re sending a little bit of personal data to them. But, what are they learning? Here’s all the details of what information they get from you.

An HTTP request is what runs the internet - on a basic level, the internet doesn’t work without them. When you clicked the link to read this page, you sent an HTTP request to Podnews’s webserver, so that it could send the page back to you. When I just did that, it looked something like…

IP Address: 101.165.34.98

Path: /articles/podcast-apps-privacy-gdpr

User-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X

            10_14_1) Chrome/71.0.3578.98

Accept-language: en-AU,en-GB

…this is very simplified, but on a basic level you can see a few things here: an IP address (my internet connection’s unique address on the internet); what type of computer I have; and even what languages I’ve configured on it.

An IP address looks like a random set of numbers, but you can look it up and you’ll discover that my IP address is in Brisbane, Australia; and every single request on the internet that I make is accompanied by this IP address. (PS: This one’s not really mine.)

We spoke to Rowenna Fielding, who works for Protecture, a company giving advice on data protection and GDPR, based in the UK. She told us that IP addresses “are treated as personal data if they allow a living individual to be pinpointed.”

An IP address by itself isn’t that helpful to learn who someone is: but perhaps you signed on to Amazon, or to Google, using it. They then know who you are (you logged in), and what your IP address is (because you’re connected to it). So it’s possible that your IP address might be enough data to work out who you are.

Here’s an actual line from our webserver, when someone asked for our podcast just now…

2018-12-19 08:32:48

78.40.XXX.XXX

/audio/podnews181218.m4a

AppleCoreMedia/1.0.0.16C50

     (iPhone; U; CPU OS 12_1_1; en_gb)

…you can see a date/time; an IP address, and a user agent.

This is a user in Paris. They’ve just downloaded yesterday’s podcast; they have an iPhone running a slightly outdated version of iOS 12; and it’s configured in British English.

I already know quite a lot about this user - certainly enough to spot them again.

However, podcasts are different

Unlike almost any other media service, podcasts don’t require sign-in.

You can use many podcast apps without logging in, opening an account, or doing anything else - just by hitting “play”, you can listen. The “only” information shared is your IP address and your user agent. And that’s really it.

Most people don’t listen to podcasts using web browsers, either (though you can). Instead, podcasts are typically listened-to using a podcast app. So if you then visit an advertiser in your web browser, while your IP address may stay the same, your user agent is different.

Podcast apps don’t use cookies either - small pieces of more permanent data to remind a website that you’ve visited before.

And many web browsers use additional privacy tools. Many iPhone users are using a “Private Relay”, a tool that hides your IP address. The same goes for you if you use a VPN or a similar service.

And, as we move to IPv6, IP addresses are much longer - like 2402:240b:2e6c:0:1d9c:c583:ed80:11e4 - and these rotate regularly to avoid them being used as personal identifiers. Here’s a quick test to see if you are running IPv6.

In reality, the amount of personal information shared in this way is really very low: it’s just your IP address - and even that, as we’ve seen, might change often.

Who GDPR applies to, and what it actually is

GDPR is the European Union’s privacy law. For the consumer, it aims to answer the question: “Who has my personal data, and what are they going to do with it?”

GDPR applies to people and organisations located in the EU; but most podcast apps are available globally, and the podcasts themselves are, too. So realistically, every single app and online service needs to comply with GDPR, if it’s likely it’ll be used by a European.

When you hit “play” or “download” on a podcast, you are making an HTTP request to the podcast host. You’re giving a podcast host - whether it’s Libsyn, ART19 or ourselves (since we self-host) - your personal data: your IP address, the type of device you use, all of that.

Our GDPR expert, Rowenna Fielding again: “The podcast app/platform needs to make it very clear in privacy info that when content is downloaded, there is personal data transferred to the content distributor (the host). The distributor also needs to clearly explain what they will do with the personal data.”

Are podcast apps clear about their privacy?

Every podcast app will leak your personal data to whoever it is who hosts the podcast when you download it. Some acknowledge how this works.

Overcast’s privacy policy says: “Overcast displays links and content from third-party podcast feeds and sites, and downloads podcast files directly from each podcast’s third-party servers. These have their own independent privacy policies, and we have no responsibility or liability for their content or activities.”

NPR’s says: “As you navigate our Services, we and our service providers also automatically collect a variety of information about your interactions with our Services” and goes into considerable detail about what they might share.

Pocket Casts doesn’t acknowledge this at all. Mind, nor did we on our podcast pages either. (We do now.)

However, from the user interface of any of the podcast apps we’ve used, the user isn’t informed who ultimately hosts that podcast, and what that end company is going to do with your personal data, partly because that information isn’t available to the podcast app.

“I think if the end user is completely uninformed about where their data is going, for what and who is involved, then there is likely to be a contravention of GDPR going on,” added Fielding.

And why does all this matter?

In Saudi Arabia, for example, homosexuality is illegal and the death penalty is applied. Listening to a gay podcast is, all of a sudden, a life-threatening pastime.

Plenty more subjects are illegal in various countries; and the global nature of podcasting means that many items discussed may be against local laws. Many countries may imprison their citizens for what they access online.

Privacy is important - but podcasting has pretty good privacy. We don’t think there’s much to worry about here.