During the last XCode beta, I was playing around with the iPhone simulator and using a proxy I saw the server would respond to geocoding requests with an 'application/x-protobuf' header. That header has since been removed, but the data is still encoded the same (comparing the same request before and after). I was going to try to figure out the RPC encoding method Apple's using, but I lost motivation after reading that they are rate-limiting the API, making it less useful to me.
straighttalk and some othe mvnos (cell service resellers) are also in the $40 ballpark for unlimited service. The only practical restriction is you can't use it for tethering.
Presumably they'll still be tracking which ads were downloaded by your device. So instead of directly sharing your data with advertisers, now the advertisers can simply do a bit of data mining to infer your data from the ads you download.
I took a look at the network traffic between the iPhone simulator and their servers and it appears they're using a proprietary variant of protocol buffers to encode the data.
As soon as somebody figures out how they tweaked the encoding, the rest should be relatively easy.
It still requires Flash: "In order to use Pandora internet radio, please upgrade to a more current browser
or install a newer version of Flash (v.10 or later)."