Windows Phone records location data without user approval

A security researcher claims to have found evidence that Microsoft's Windows Phone 7 records location data from the camera application without user consent, directly contradicting statements by the firm.

The discovery comes as Microsoft attempts to fend off a lawsuit from a US resident accusing the company of tracking user data without permission, which Microsoft has described as baseless.

However, Rafael Rivera explained in a blog post that tests of new devices and those running different versions of the software showed that they attempt to gather data without express permission.

Information harvested by the phone to be sent on to Microsoft includes operating system version, device type, and the Media Access Control address of nearby wireless access points. Rivera noted, however, that this does not mean that data is actually sent on.

"In my case, the phone determined its exact location via Microsoft services prior to me explicitly allowing such behaviour," he said.

"The question is whether the Microsoft servers in question are in fact collecting data about the phone or simply returning this information with no storage abilities."

However, Rivera highlighted two contraventions of Microsoft's privacy policy that could cause serious headaches for the company.

"Microsoft does not collect information to determine the approximate location of a device unless a user has expressly allowed an application to collect location information," the policy reads.

"Microsoft only collects information to help determine a phone's approximate location if (a) the user has allowed an application to access and use location data, and (b) that application actually requests the location data."

V3 contacted Microsoft for comment but had received no reply at the time of publication.

The revelations, if true, will be a huge embarrassment to Microsoft. Streetside, the company's rival to Google's Street View, has already drawn warnings from data privacy groups to ensure that Microsoft avoids the same data collection problems as Google.