1. [thread] We are filing legal complaints against six companies based on our research, revealing systematic breaches to privacy, by shadowy #OutOfControl #adtech companies gathering & sharing heaps of personal data. forbrukerradet.no/out-of-control… #privacy 
2. We observed how ten apps transmitted user data to at least 135 different third parties involved in advertising and/or behavioural profiling, exposing (yet again) a vast network of companies monetizing user data and using it for their own purposes.
3. Dating app @Grindr shared detailed user data with a large number of third parties. Data included the fact that you are using the app (clear indication of sexual orientation), IP address (personal data), Advertising ID, GPS location (very revealing), age, and gender.
5. This extensive collection, combination and use of persistent identifiers enables tracking across apps and devices, and the creation of comprehensive profiles on individual consumers.
6. @Google plays a key role in this system with the Android Advertising ID, which allows companies to track consumers across different services, was transferred to at least 70 different third parties, often transmitted in combination with GPS location and IP address
7. And @Facebook is embedded in most of the apps we researched as well, corresponding with research conducted by many others
8. Is it really that bad, isn’t it just more relevant adds? Since our smartphones are always with us, and monitor us 24/7, the potential to target us when we are the most vulnerable increases.
9. Microtargeting can be used to manipulate, exclude & discriminate. You can be excluded from receiving certain offers or being placed in a category of “undesirables”, which you have no knowledge of or control over. amnesty.org/en/latest/news… @amnesty
10. There are also significant security concerns. Every company that collects such data may be subject to a data breach, or can simply sell the data. This can lead to a variety of consumer harms, including identity theft, fraud & blackmail. #infosec
11. Will this not kill the “free” internet as we know it? No, there are other business models to serve ads, that does not violate people’s right to privacy. They need air to breathe and a level playing field where all actors respect basic rights. #competition
12. What happens now? The digital marketing and adtech industry has to make comprehensive changes in order to comply with European regulation, and to ensure that they respect consumers’ fundamental rights and freedoms.
13. Together with privacy experts @NOYBeu & @maxschrems, we have concluded that this data sharing is in breach of the GDPR (no consent, no legitimate interest & special category data). Thus we are filing several legal complaints today: forbrukerradet.no/side/complaint…
14. Altogether, more than 25 groups globally has joined this action, writing to authorities, urging them to investigate. This includes @Consumentenbond @consumernz @ekpizo @frc_CH @SvKonsumenter @UFCquechoisir @OpenRightsGroup @vki_konsument @WhichUK @zpsslo @beuc @Consumers_Int
15. in the US, nine groups have teamed up to write to the @FTC @USCongress & AGs. Groups are @ACLU @commercialfree @DigitalDemoc @consumer_action @ConsumerFed @ConsumerReports @EPICprivacy @Public_Citizen @uspirg consumerreports.org/privacy/popula…
16. On the basis of these findings, we urge data protection authorities to enforce the GDPR, & for advertisers & publishers to look toward alternative digital advertising methods that respect fundamental rights. These illegal practices must end!
17. This is about having control over our lives. When data is being shared and used without control, decisions about us can be made without our knowledge, and without any way to challenge or change their outcome. [end]
