Thread by @SarahisCensored

🚨EXCLUSIVE: Independent Technical Review Raises Serious Privacy Questions About Abbott Campaign App!

The Abbott Impact App

A THREAD 👇

At the 2026 Texas Republican Convention, many delegates were encouraged to download the Abbott Impact app as part of Governor Greg Abbott’s grassroots campaign efforts. Many also gave the app permission to access the contacts stored on their phones.

The promotion did not end when the convention concluded. As delegates returned home, they received one final text message from the Abbott campaign encouraging them to download the Abbott Impact app. The message described the application as a “free tool” that would allow Republican activists to help turn out voters through phone calls, text messages, and door knocking, and included a direct download link to the app. A screenshot of that text message is included with this report.

At the time, most users likely believed they were simply helping the campaign identify registered voters among their friends and family.

Now, an independently verified technical review is raising questions about what information the app actually collects, where that information goes, and whether users were given a COMPLETE explanation before agreeing to share it.

According to the analysis, the app can access far more than just names and phone numbers. It is capable of reading email addresses, mailing addresses, employer information, notes saved with contacts, photographs, messaging accounts, and other information stored in a user’s address book.

One of the report’s biggest concerns involves the information presented to users before they agree to share their contacts.

The app tells users:

“Your personal information and contact details remain private. No one outside of the campaign will be able to see your answers or notes.”

However, according to the independently verified technical review, the contact information uploaded through the app is transmitted to computer servers operated by a third-party company called Right Impact LLC. The report concludes that users were NOT clearly informed that a third-party company would receive and process that information when they were asked for permission to upload their contacts.

The report also found that the app collects additional information used for analytics and advertising that is not explained to users during the consent process. It further raises questions about whether the app’s disclosures are consistent with the requirements of the Texas Data Privacy and Security Act (TDPSA) - the VERY PRIVACY LAW signed by Governor Abbott that took effect on July 1, 2024.

Read on 👇

According to the technical analysis, the Abbott Impact app failed 9 OUT OF 10 TDPSA compliance markers, with the remaining category classified as indeterminate. In other words, the reviewers found that none of the ten evaluated compliance requirements were clearly met. Among the concerns identified were the absence of a compliant consent mechanism for sensitive geolocation data, missing disclosures regarding third-party data processing, no identified implementation of the Global Privacy Control standard required under Texas law, and limited mechanisms for users to exercise their privacy rights. These findings reflect the conclusions of the technical review and are not, by themselves, a legal determination that any law has been violated.

The report is equally clear about what it does not claim. It does not allege that anyone’s data has been sold, leaked, or improperly shared beyond the identified third-party processor. Instead, it concludes that the app’s documented behavior differs from what users are told when they decide whether to share information from their phones.

The application underwent an independent technical review of the decompiled Android application, including analysis of the source code, application manifest, embedded resources, and application architecture. The report also references an accompanying independent audit, providing an additional layer of technical verification supporting the findings regarding how the application collects, processes, and discloses user information.

These findings come at a time when many Texas Republicans are already asking questions about how party data is handled. According to public statements from Chairman Josh McKaughan’s team, former RPT Chairman Abraham George exported the Republican Party of Texas Mailchimp database shortly after losing his reelection bid. While there is no evidence connecting that incident to the Abbott Impact app, both situations have prompted renewed concern about who has access to grassroots data, how it is stored, and what protections are in place for supporters who entrust political organizations with their personal information.

I AM CURRENTLY looking into and investigating the allegations made against Abraham George.

For delegates who downloaded the app at the Texas Republican Convention, you might want to reconsider. Many were encouraged to install the application in good faith, trusting that they understood how their information would be used.

The findings have already undergone independent technical verification and an additional independent audit. The remaining questions are not about whether the application performs these functions, but whether users were given complete and accurate information before deciding to share data from their phones.

Among the questions that deserve answers:

Were users clearly informed that a third-party company would receive and process their contact information?

Why does the consent screen state that no one outside the campaign will see users’ information? This is blatantly false.

If the application failed 9 out of 10 TDPSA compliance benchmarks, what steps, if any, have been taken to address those findings?

What information is retained after contacts are uploaded?

How long is that information stored?

What safeguards are in place to protect the personal information entrusted to the app?

Those are questions both the Abbott campaign and Right Impact LLC should have the opportunity to answer.

Report part 2

This is the full Technical Dossier for all of my “tech junkies” out there.

Abbott Impact - TDPSA Compliance Analysis - Part one

Abbott Impact - TDPSA Compliance Analysis - Part two

Abbott Impact - TDPSA Compliance Analysis - Part three

@threadreaderapp unroll