Weather forecasting company AccuWeather Inc. has allegedly been caught spying on users.

A report published Tuesday detailed how its iPhone app sends data back to the company and an advertising partner even when users don’t give it permission.

First spotted by security researcher Will Strafach, the AccuWeather iOS app is alleged to send location data to the company along with details of the Wi-Fi router to which the phone is connected and its Media Access Control or MAC address. At least some of that data is also forwarded to AccuWeather’s “data monetization” partner Reveal Mobile, allowing the ad company to identify where a user is currently located, including in some cases an actual physical address.

Raleigh, North Carolina-based Reveal Mobile Inc. is a “data tracking” company that claims on its website to convert “mobile location signals into high value audiences,” allowing partners to “generate more mobile revenue, with or without ads.” How it generates revenue without advertising isn’t particularly clear, but it may be selling data to other ad companies.

In Strafach’s test, his Apple Inc. iPhone sent data to both AccuWeather and Reveal Mobile 16 times over a period of 36 hours, “roughly once every few hours.”

An app sending data back to the company or related organizations is hardly new, but the case is notable because the AccuWeather app does so even when permission is not granted by the app user.

In a statement, Reveal Mobile attempted to put the blame for the data sharing on AccuWeather, saying that it follows “all app store guidelines, honoring all device level and app level opt-outs and permissions.” For its part, AccuWeather denied the allegations, saying in its separate statement that “despite stories to the contrary from sources not connected to the actual information, if a user opts out of location tracking on AccuWeather, no GPS coordinates are collected or passed without further opt-in permission from the user.”

Disturbingly, Strafach added, the Reveal Mobile software development kit — seemingly behind the alleged nefarious data sharing — is used by a number of other iOS apps. But in testing 40 apps that use the SDK, he could identify similar behavior in only one, named “Frank’s Forecast Weather App.”

Photo: Ron Shawley/Wikimedia Commons