Erica Sudan of O'Reilly is speculating that Apple may be tagging the AAC section of iTunes Plus tracks.
Erica's research led her to create a secondary iTunes account and download two tracks on two separate accounts.
This morning I created a new account over at the iTunes store. And I downloaded a second copy of the iTunes Single of the Week “Ooh La” by the Kooks using my brand new account. I copied them both to the desktop and renamed them to OrigOld (downloaded Wednesday) and OrigNew (downloaded today).
Here are Erica's results:
-rw-r--r-- 1 ericasad ericasad 6899988 Jun 1 08:45 OrigNew.m4a
-rw-r--r-- 1 ericasad ericasad 6899978 May 31 19:46 OrigOld.m4a
The files are different in size, Erica states that the extra 10 bytes is due to her new username, so she decided to delve deeper.
Sudan then ran much more accurate checks on the files and noticed clear differences, her conclusion:
"Clearly some sort of fingerprinting/steganography is going on in the data itself."
The EFF is reportedly also looking into the situation.
It should be noted that iTunes' Terms of Service does allow such information to be embedded into downloaded files.