In the wake of the controversy regarding Path's address book skimming, two members of Congress today penned a letter to Apple asking the company for more information about iOS apps that access users' contact lists.
Separately, Twitter said this week that an upcoming app update with include more information about how the micro-blogging service accesses and stores app users' address books.
Democratic Reps. Henry Waxman and G.K. Butterfield, ranking members on the House Energy Commerce Committee, said in a Wednesday note to Apple chief Tim Cook that the Path "incident raises questions about whether Apple's iOS app developer policies and practices may fall short when it comes to protecting the information of iPhone users and their contacts."
In a statement, an Apple spokesman said that "apps that collect or transmit a user's contact data without their prior permission are in violation of our guidelines."
"We're working to make this even better for our customers, and as we have done with location services, any app wishing to access contact data will require explicit user approval in a future software release," the spokesman continued, though he had no further details.
Earlier this month, Path CEO Dave Morin acknowledged that Path uploads the entire iPhone address book without user permission on the iOS version of the app. It came to light after iOS app developer Arun Thampi blogged about the glitch. Morin then apologized and released a new version of the Path iPhone app that allows users to opt in or out of sharing contact information.
The practice, however, is apparently not limited to Path. A recent Instagram update, for example, added a permissions menu regarding address book access to avoid similar scrutiny.
As first reported by the LA Times, meanwhile, Twitter plans to update its app notifications regarding address book access. When users choose "Find Friends" via the Twitter app, they upload their contacts to the service so that Twitter can inform them which of their friends they might want to follow. But a Twitter spokeswoman said today that Twitter does not automatically upload these contacts and they can be removed at any time.
"We want to be clear and transparent in our communications with users. Along those lines, in our next app updates, which are coming soon, we are updating the language associated with Find Friends – to be more explicit," the spokeswoman said via email. "In place of 'Scan your contacts' we will use 'Upload your contacts' and 'Import your contacts' (in Twitter for iPhone and Twitter for Android, respectively)."
Reps. Waxman and Butterfield, however, want to know what role Apple plays in all this. They pointed to the iOS developer website, which says iOS apps provide "access to a device's global data such as contacts in the Address Book." But iOS App Guidelines require apps to get a user's permission before "transmit[ting] data about a user," the congressmen said.
They also cited blogs that describe a "quiet understanding among many iOS app developers that it is acceptable to send a user's entire address book."
"The fact that the previous version of Path was able to gain approval for distribution through the Apple iTunes Store despite taking the contents of users' address books without their permission suggests that there could be some truth to these claims," Waxman and Butterfield wrote.
To that end, the duo has asked Cook to provide more details about iOS app guidelines and how data is collected. They asked for responses by Feb. 29.
Cook made an appearance yesterday at the Goldman Sachs Technology and Internet Conference, where he said that tablets will one day outsell PCs and defended the working conditions of the company's international suppliers, arguing that "we care about every worker." He also discussed what Cupertino might do with its cash hoard.
For more, see PCMag's review of Path and the slideshow below.
Editor's Note: This story was updated at 2pm Eastern with comment from Apple.