The iOS Address Book: Jennifer Van Grove finally sets the record straight  

This issue has been beaten to death, but Jennifer Van Grove has written a great article at VentureBeat that includes some digging and actual facts:

Facebook, Twitter, Instagram, Foursquare, Foodspotting, Yelp, and Gowalla are among a smattering of iOS applications that have been sending the actual names, email addresses and/or phone numbers from your device’s internal address book to their servers, VentureBeat has learned. Several do so without first asking permission, and Instagram and Foursquare only added permissions prompts after the Path flare-up. […]

Finally, some real sleuthing. She even caught Yelp in a fib:

Yelp also claims that it does not store the data and requests user permission when accessing the address book. “When a repeat user launches the Yelp application, we provide a prompt for them to give their explicit permission to Find Friends via their Contact list,” a Yelp rep said. However, when VentureBeat tested this feature, we didn’t get a prompt.

When we pointed this out, the Yelp representative said that the prompt only appears the first time you launch the application.

Ha. Of course, they’re fixing that in a future release.

Finally, Van Grove concludes (and hopefully provides a satisfying conclusion to the entire “scandal”):

Considering that the practice of uploading address book data is so widespread, the answers to those questions [about security and privacy] are unknown, and the uncertainty is enough to make even the most trusting of people paranoid.

Two things need to happen now. Most importantly, Apple needs to provide an operating system-level prompt to the user before revealing any local data to an app. Until then, developers need to stop reading and transmitting contacts information without the user’s explicit permission.