Apple Blocked the Shake Ad. Baidu Netdisk’s Old App Found a Compass.

After iOS 27.2 added “Restrict Motion Data,” the test looked simple. Add an app to the list. The system cuts accelerometer and gyroscope access. The splash ad still appears. Shaking the phone should no longer open the ad. Older Baidu Netdisk builds still opened it. How?

Start with the timeline. The iOS 27.2 beta kept the China-only feature. The entry is tied to Apple ID region. A user manually adds an app to the list. Listed apps cannot get motion data. A standard shake ad collects accelerometer and gyroscope data during the splash screen. An algorithm checks rotation angle and acceleration against a threshold. Low thresholds fire on walking or bus vibration. With the restriction on, the ad still shows. Sensor data is cut. Shaking does nothing. Old Baidu Netdisk broke that expectation.

Reverse-engineering pointed to “NoShake.” The Baidu Netdisk iOS ad framework has an implementation that switches sensors when motion data is blocked. The substitute is the magnetometer. A magnetometer is the compass part that senses Earth’s magnetic field and phone orientation. When the phone tilts, the field’s projection on the X, Y, and Z axes changes. An app can read heading and magnetic-field data through the CLHeading API in Apple’s Core Location framework. It can analyze small changes in that data and infer rotation.

“Breaking the hardware layer” is the wrong phrase. iOS 27.2 restricted accelerometer and gyroscope data. The old app used a sensor outside that list. It did not open the hardware. It found another variable that could infer posture. The system splits permissions by sensor type. The app works backward from its goal: decide whether the user moved the phone. If that decision can still be made, the trigger chain survives.

A person familiar with the matter said the Baidu Netdisk team did not deliberately circumvent the feature. The claim was that App Store review is strict, the new build had not passed review, and the adapted build would arrive within days. The next event supports that account. Baidu Netdisk released 13.36.5 on November 2. iOS 27.2’s restriction blocks that build. The version that could still shake out an ad was likely the unadapted build still in the App Store.

“New build not live yet” explains the time window. It does not explain why the old build contained a fallback like NoShake. A better explanation has two parts. Ad frameworks prepare alternate paths so they can keep triggering under different sensor permissions. The new build is the compliance step. The old build is the leftover. Both are true. That is why the early coverage made it look like only Baidu Netdisk could still trigger the ad. The direct cause was a version mismatch. The fallback sensor was the condition. The commercial incentive was the reason the fallback existed.

Privacy needs its own split. Magnetometer data stayed on the phone. The “is the phone shaking” judgment ran locally. The classic privacy leak is raw sensor data going to a server. That did not happen here. But local inference is still collection. The user turned off “Motion & Fitness” to stop the app from collecting data about motion posture. The old build used another sensor that was not restricted. It inferred walking, stillness, or rotation in the background. The user thought motion permission was off. In practice, only the accelerometer and gyroscope in the system list were off. The magnetometer path was outside the user’s intuition and outside the restriction list at that time.

The app treated permission as a sensor list, not as user intent. The system said: the user does not agree to this data collection. The app said: if this data is blocked, use another data source that leads to the same conclusion. Risk can sit inside the device, not only at the upload step. To prove infringement, a regulator would need evidence of the collection behavior, the inference logic, and the conflict with user consent. That requires access to app behavior and code-level evidence. Regulators also face evidence-gathering problems and weak penalties. “Switch sensors and keep inferring” stays in a gray zone.

Apple’s restriction has clear limits. It blocks motion data. It does not block ad jumps. It covers the accelerometer and gyroscope. It does not cover the magnetometer or other sensors that can infer posture. App review can block a clearly non-compliant build. It cannot predict every alternate sensor combination in every review. A stronger fix would be a behavior-level switch that blocks splash ads from auto-opening other apps. Review should treat “use another sensor to get around a user restriction” as a review issue. Regulators should define what counts as feature circumvention.

After November 2, the same switch worked on Baidu Netdisk. The old build’s window closed. Users should not need reverse-engineering skills or a magnetometer tutorial. A switch should work as a switch.