Three iTunes users are suing Apple for allegedly disclosing their listening habits to advertisers. The users, who hail from Rhode Island and Michigan, claim Apple violated laws protecting records of entertainment purchases in those states. They’re seeking class-action status alongside other state residents, saying Apple has “disregarded its legal responsibilities to these individuals” by revealing personal information.

The lawsuit claims that Apple has released personal listening information directly to third parties while also granting app developers access to iTunes libraries through the Media Player framework. It draws on specific public criticism of Apple’s privacy practices, as well as the general availability of private user data through data brokers. It also speculates that Apple’s data disclosures are responsible for the plaintiffs receiving unsolicited junk mail based on their listening history.

Users say they were barraged with junk mail

As Variety says, data brokers gather information from many sources — so iTunes user data could be obtained through financial records that aren’t directly related to Apple. Apple’s Media Player documentation currently tells developers that they must get permission from users before accessing music libraries, and it says that they’re “not permitted to use this framework to gather information about the user’s audio content, or to use such information for any purpose other than audio playback within your app.” The lawsuit notes that Apple was criticized for automatically allowing full access a few years ago, though, and the plaintiffs say Apple still makes it too easy to gather data through iTunes.

These claims contrast with Apple’s vocal pro-privacy stance. In its introduction, the suit prints an ad from earlier this year, where Apple claims that “what happens on your iPhone, stays on your iPhone” — something the plaintiffs say is “plainly untrue.” Online media services have run afoul of privacy laws before. Netflix, for instance, settled a class-action lawsuit claiming that it had violated the Video Privacy Protection Act. However, previous privacy claims against Apple have been dismissed because the users couldn’t establish that they’d been harmed.