&gt;The data they collected was list of installed apps, serial numbers, and some sort of AppleID numeric identifier. In particular, they did not (could not) collect email addresses.<p>[Edited for unnecessary stuff]<p>Oh the article you linked has Apple response that is quoted verbatim below - it references user email addresses. Specifically.<p>“We’ve identified a group of apps that are using a third-party advertising SDK, developed by Youmi, a mobile advertising provider, that uses private APIs to gather private information, such as user email addresses..&quot;<p>&gt; Please stop confusing private methods with elevated permissions. You CAN call private methods without elevated permissions, as my code above demonstrates.<p>What I wrote was you are not going to be able to call an Android API via private invocation and succeed if the API requires a specific permission and your app hasn&#x27;t declared it.<p>All of this only goes to prove that Apple&#x27;s security in iOS is not extraordinary as you claim - it is fallible like every other platform except with the exception of fingerprints which are currently believed to be secure - but that&#x27;s now the case with Android as well - in M they are using ARM Trust Zone with no app access.