APIs and Your Privacy

Overview

In 2018, Fordham CLIP received a gift from AT&T to research and publish a report to educate the public on how application programming interfaces (APIs) are used by consumer-facing websites and mobile applications to gather data. On February 5th, 2019, Fordham CLIP, in collaboration with the University of Michigan's School of Information, released the report "APIs and Your Privacy." The interdisciplinary project describes how APIs function technologically and in practice and examines how APIs are used to facilitate data sharing and use.

Authors

N. Cameron Russell, Executive Director, Fordham CLIP (2013-2018)
Florian Schaub, Assistant Professor, University of Michigan School of Information
Allison McDonald, PhD Candidate, University of Michigan College of Engineering
William Sierra-Rocafort, Project Fellow, Fordham CLIP

Executive Summary

Application programming interfaces, or APIs, have been the topic of much recent discussion. Newsworthy events, including those involving Facebook's API and Cambridge Analytica obtaining information about millions of Facebook users, have highlighted the technical capabilities of APIs for prominent websites and mobile applications. At the same time, media coverage of ways that APIs have been misused has sparked concern for potential privacy invasions and other issues of public policy. This paper seeks to educate consumers on how APIs work and how they are used within popular websites and mobile apps to gather, share, and utilize data.

APIs are used in mobile games, search engines, social media platforms, news and shopping websites, video and music streaming services, dating apps, and mobile payment systems. If a third-party company, like an app developer or advertiser, would like to gain access to your information through a website you visit or a mobile app or online service you use, what data might they obtain about you through APIs and how? This report analyzes 11 prominent online services to observe general trends and provide you an overview of the role APIs play in collecting and distributing information about consumers. For example, how might your data be gathered and shared when using your Facebook account login to sign up for Venmo or to access the Tinder dating app? How might advertisers use Pandora's API when you are streaming music?

After explaining what APIs are and how they work, this report categorizes and characterizes different kinds of APIs that companies offer to web and app developers. Services may offer content-focused APIs, feature APIs, unofficial APIs, and analytics APIs that developers of other apps and websites may access and use in different ways. Likewise, advertisers can use APIs to target a desired subset of a service's users and possibly extract user data. This report explains how websites and apps can create user profiles based on your online behavior and generate revenue from advertiser-access to their APIs. The report concludes with observations on how various companies and platforms connecting through APIs may be able to learn information about you and aggregate it with your personal data from other sources when you are browsing the internet or using different apps on your smartphone or tablet. While the paper does not make policy recommendations, it demonstrates the importance of approaching consumer privacy from a broad perspective that includes first parties and third parties, and that considers the integral role of APIs in today's online ecosystem.

Events

CLIP Executive Director Tom Norton and Florian Schaub, assistant professor at the University of Michigan School of Information presented the report at the AT&T Policy Forum's Symposium on Application Programming Interfaces and Privacy in Washington, D.C., on February 5th, 2019.

A policy panel moderated by Sara Fischer, Axios, followed, with participants: Danielle Coffey, Senior Vice President, Strategic Initiatives and Counsel, News Media Alliance; David LeDuc, Vice President, Public Policy, Network Advertising Initiative (NAI); Maureen K. Ohlhausen, Partner and Co-Chair, Antitrust Practice, Baker Botts; Michelle Richardson, Director of the Privacy & Data Project, Center for Democracy & Technology; John Verdi, Vice President of Policy, Future of Privacy Forum; and other industry and policy experts.