As MMW previously reported, the MMA Mobile Application Privacy Policy was created by the MMA Privacy & Advocacy Committee in response to the rapid growth in mobile app popularity among smartphone users and mobile marketers.

“Mobile app developers asked for clear, transparent policy language that consumers can quickly and fully understand,” says MMA Global CEO Greg Stuart. “Today’s release, the first in a series of privacy policy guidelines that the MMA is creating with input from industry leaders, gives the app development community the meaningful support they need.”

The key issues addressed in the guidelines include:

• Annotated guidance on core privacy principles and consumer-friendly language for developers to consider using
• Ways to inform users on how data is obtained and used
• Guidance on security and confidentiality of information

“Privacy policies are a key consumer disclosure tool for app developers and important to establishing and maintaining consumer trust,” adds Alan Chapell, Co-chair of the MMA Privacy & Advocacy Committee. “Our guidelines offer developers the foundation from which to craft a document that reflects the privacy practices of each of their apps and helps them stay in compliance with applicable law and industry standards. We urge app developers to consult with their legal counsel when adapting these guidelines for their purposes.”

Launched this month, the MMRA was founded with the mission of uniting and serving the industry by developing professional standards and ethics to advance the use of mobile devices for marketing research.  According to its press release, the MMRA says it’s an “action-oriented organization designed to establish mobile research guidelines and best practices for sustainable growth, develop research and advocate for issues that grow the industry, provide quality education and evangelize the mobile marketing research channel for use by clients, researchers and participants.”

Why does the industry need a trade organization dedicated to mobile marketing research?  First a little background on where the MMRA got its start.  There was a conference held last year in both Berlin and Atlanta, GA called “Market Research in the Mobile World,” which was organized by the Merlin Institute.  The event turned out to be relatively successful, with over 170 attendees at the Atlanta event alone.  Following the conference, Jasper Lim, founder of the Merlien Institute and Mark Michelson, a veteran in the marketing research industry, discussed how this so-called  ”fast developing and complex industry” needs a unifying body, a single voice, and a place to exchange the best and most innovative of ideas.  In September 2011 they decided to work together to create the MMRA, which is making its formal debut this month.

As mobile marketing and advertising continues to gain unprecedented momentum, there’s a variety of issues stemming from what information and data is collected from mobile users, how it’s used and how the entire process should be regulated.  ”Consumer privacy is a concept that research participants seem willing to sacrifice, at least in part, to receive valuable offers that are tailored towards their likes and interests,” explained the MMRA.  ”Millions of consumers have already downloaded smartphone apps that use GPS to track their location so they can obtain discounts, coupons or cash incentives for answering a few questions about their experience when they are in specific stores. These apps are becoming more popular every day.”

Among other initiatives, the MMRA wants to design studies that take advantage of  new mobile technologies and changes in respondent behavior, explore ways to make sense of complex data and set guidelines for ethical use of personal information.  The MMRA said it will accomplish this through the “cooperative efforts of the best professionals in the industry who want to make research more meaningful for clients and enjoyable for participants.”

Launching just this month, the MMRA is putting a call out to relevant organizations to join its cause.  The first 300 member companies to join will have special certification recognizing their permanent status as a founding member.  “The business world recognizes innovators and leaders who get in on the ground floor; that kind of foresight is recognized, repeatedly and in so many ways,” said Michelson, who has founded and worked with other marketing research related trade associations in his career. “Founding Members stand out to their prospects, their peers and others key influencers in the business world.”

In case you’re unfamiliar, the Carrier IQ software is what’s known as a rootkit that is installed at a carrier’s request on mobile phones. Carrier IQ raises user privacy concerns because it runs in the background and monitors and logs user activity. Carrier IQ is known to be installed on well over 100 million devices around the world.

As of today, however, Sprint Nextel says Carrier IQ software is effectively erased from devices across its network. The move was achieved in part by Sprint’s partnership with HTC, which yielded a firmware update targeting Carrier IQ.

“HTC can confirm that we’re working with Sprint to provide maintenance releases that will remove Carrier IQ and provide security enhancements and bug fixes beginning in January,” HTC admits, according to The Verge.

Until now, carriers like Sprint and AT&T previously claimed that the Carrier IQ software and its collected data have only been used as a means to “improve service performance.”

Do you feel more confident about your mobile usage now that Carrier IQ has been dumped by Sprint?

The admission comes in response to calls from U.S. lawmakers to beef up safeguards of customer privacy.

According to a report from Bloomberg, approximately 450,000 T-Mobile customers “use nine devices containing the software that provides data including telephone numbers dialed and received.”

T-Mobile maintains that it doesn’t use the software to view texts, e-mails, photos, videos or monitor voice messages, log keystrokes or Internet activity.

“Motorola Mobility neither received nor had access to any data collected by the Carrier IQ software, with the exception of approximately 125 devices used for testing the Carrier IQ software implementation,” T-Mobile says.

The software is used only “to obtain data about the nearest cell phone tower,” the company added, while noting that “customers expect us to take pro-active steps, including the use of reasonable diagnostic tools, to ensure network reliability and enhance our customers’ device experience.”

The Carrier IQ software is what’s known as a rootkit that is installed at a carrier’s request on mobile phones. The software raises user privacy concerns in light of the fact that it runs in the background and monitors and logs user activity.

Carrier IQ is believed to be installed on well over 100 million devices today.

The class action lawsuit was filed by Delaware-based Sianni & Straite LLP. The suit targets Apple, HTC, Samsung and Motorola. Wireless carriers AT&T, Sprint and T-Mobile are also named in the lawsuit that alleges an “unprecedented breach in the digital privacy rights of 150 million cell phone users.”

AT&T and Sprint claim the Carrier IQ software is only used as a means to “improve service performance.”

In response to the Carrier IQ scandal, Apple announced that “stopped supporting Carrier IQ with iOS 5 in most of our products and will remove it completely in a future software update.”

The new privacy policy marks the first of its kind to address the “core privacy issues and data processes of many mobile applications,” according to the MMA.  “These new privacy policy guidelines fill an urgent need for all companies doing business in the mobile marketing industry.  The guidelines are intended to provide ways to give the mobile application developer a clear and transparent policy language that can be quickly and completely understood by the consumer,” said MMA Global CEO Greg Stuart.  “Today’s release is the first in series of privacy policy guidelines that the MMA will create with the input of industry leaders across the mobile ecosystem.”

The new guidelines address issues related to things like guidance on core privacy principles and consumer-friendly language for developers to consider using, as well as ways to inform users on how data is obtained and used and how to deal with security and confidential information on behalf of potential users.  Members of the mobile marketing industry (marketers, app developers, media companies, advertising agencies, technology enablers and other) are encouraged to read the proposed guidelines and submit comments to the MMA.  After the comment period closes on Friday, November 18, 2011 the feedback will be reviewed and the privacy policy guidelines will be finalized and released.

You can download a full copy of the policy guidelines here.

For now, the policy applies to all customers although Verizon says they can opt out if they want.

Verizon says the reason for the privacy change is that the data collected will help them make the “mobile ads you see more relevant.”

Additionally, Verizon revealed that all the data shared with outside companies will be anonymized and that Verizon “will not share outside of Verizon any information that identifies you personally.”

According to the Los Angeles Times, the types of information Verizon will now track and share includes:

Mobile Usage Information:

• Addresses of websites you visit when using our wireless service. These data strings (or URLs) may include search terms you have used
• Location of your device (“Location Information”)
• App and device feature usage

Consumer Information:

• Information about your use of Verizon products and services (such as data and calling features, device type, and amount of use)
• Demographic and interest categories provided to us by other companies, such as gender, age range, sports fan, frequent diner, or pet owner (“Demographics”)

Earlier this year, Apple found itself on the receiving end of comparable complaints and potential legal threats.

In this particular instance, plaintiff Rebecca Cousineau alleges that tech giant Microsoft is proceeding with the development of a targeted location-based advertising system and, as a result, continues to “map the locations of cell towers, wireless routers, mobile phones, and computers to do so effectively.”

The complaint alleges that Microsoft chose to collect this information from Windows Phone users rather than go through the expensive and laborious process of collecting the information itself.

“Microsoft’s scheme is executed through its camera application, which comes standard with a mobile device running the Windows Phone OS,” the complaint states, according to a published report from InformationWeek.

“Microsoft brazenly continues to collect users’ location information, regardless of whether or not the individual chooses ‘cancel’ so as to not allow such information to be tracked,” the complaint adds. “Thus, Microsoft surreptitiously forces even unwilling users into its non-stop geo-tracking program in the interest of developing its digital marketing grid.”

There’s been a lot of noise lately in the mobile marketing industry about long codes, some are even questioning if these will be the death of short codes. I’m still bearish on long codes as the carriers have yet to come out publicly and give their approval for long code A2P (application to person) messaging. This post though isn’t about long codes being approved or not approved by the carriers, or even if long codes are a good substitute for short codes. This post is about why I feel text message spammers are on the verge of a mass exodus away from short codes to long codes.

Here are my three reasons why text message spammers will love long codes, and in-turn will make the migration.

1. Low Messaging Costs - There is one thing that all spammers have in common, if there are two methods of spamming that achieve the same results, they will always pick the cheapest method. Sending messages through a long code is significantly cheaper than through a short code, especially when you factor in the cost to setup and manage a short code.

2. Easy Setup - Screw applying for a short code, waiting, signing contracts with aggregators, waiting, submitting campaigns to the carriers for approvals and waiting some more. With long codes, there are no approvals, no setup fees, really nothing getting in the way of spammers sending their first text message.

3. No Stupid Rules - Spammers don’t want to have to comply with stupid rules and audits of those rules, that kind of stuff just gets in the way of spamming. With long codes, no one is watching, so feel free to say fuck you to the MMA Best Practices, the mobile carriers, the CTIA, etc.

4. Hiding is Easy - Have you ever tried to find out who to blame for those long code spam messages you’ve been receiving? It’s nearly impossible, even with the almighty Google. Spammers love staying anonymous, and with short codes that is hard to do with things like The US Common Short Code WHOIS Directory, The CSC Directory and SMS Watch Dog. With long codes though, spammers are able to cycle through batches of different phone numbers with each and every campaign, dodging detection with every message.

Now that I think about it, I actually love long codes. It’s a fact of life that there will always be people wanting to send text message spam, but with the rise of long codes, these spammers will now have a new home. After this migration to long codes, short codes will once again be a spam-free haven for SMS marketing.

The amount of personal health information (PHI) stored and accessed on mobile devices is ever increasing, with 10,000 mobile healthcare applications existing that allow users to access electronic health records (EHR).

Additionally, one in three physicians own an iPad, and another 28 percent are planning on purchasing one within the next six months. This doesn’t even include the privacy risk that the 64 percent already using a smartphone produces.

With numbers like these, it is clear that a lot of patient data is at jeopardy. In fact, the Office of Civil Rights has reported that within the past two years, the PHI of 1.9 million patients has been exposed. This release of private information is linked to 116 data breaches of over 500 records due to the theft or loss of mobile devices.

These numbers are not only troubling from a legal standpoint, but also from a business view, as consumer confidence in electronic health records wavers in response.

However, this does not need to be the case. The president of ID Experts Rick Kam explained that there are several steps that healthcare providers can take to make certain that patient privacy is maintained and these security breaches are averted.

This includes measures for securing wireless devices such as encrypting any sensitive data, using a password for protection, and setting the lock screen to appear after a short period of time without activity. Additionally, enabling the “remote wipe” feature on mobile devices allows physicians to erase data from lost or stolen devices, preventing situations such as those that have led to the breach of almost two million patients’ information recently.

Other measures that Kam suggests revolve around the protection of healthcare providers’ Wi-Fi networks. This includes suggestions such as using a password protected Wi-Fi network, changing the default service set identifier, and keeping this information private.

By following the steps Kam laid out and relying on best practices, convenience and mobility do not have to mean a simultaneous reduction in privacy standards.