NEW: We examined in detail how 10 popular smartphone apps secretly share extensive personal information with at least 135 companies, systematically breaking EU data protection law. This must end.
Two massive reports + legal complaints against 6 companies: forbrukerradet.no/side/new-study…
Two massive reports + legal complaints against 6 companies: forbrukerradet.no/side/new-study…
I helped with the investigation, led by the Norwegian Consumer Council. It took several months and also involved @thezedwards, technical analysis by security firm Mnemonic and legal expertise by @NOYBeu.
25 orgs in the EU/US are urging authorities to act:
25 orgs in the EU/US are urging authorities to act:
@thezedwards @NOYBeu We observed 8 data companies receiving detailed GPS location info, in combination with unique personal IDs, when using the gay/bi dating app Grindr, including MoPub (owned by Twitter), Bucksense, PubNative, OpenX, AdColony, Braze, Smaato and Vungle.
p125: fil.forbrukerradet.no/wp-content/upl…
p125: fil.forbrukerradet.no/wp-content/upl…
@thezedwards @NOYBeu We observed location data brokers receiving data from the period tracking app MyDays, e.g. Placer (received GPS/WiFi/celltower data) and Placed/Foursquare (received GPS location >250 times + a list of installed apps).
p40: fil.forbrukerradet.no/wp-content/upl…
p95+99: fil.forbrukerradet.no/wp-content/upl…
p40: fil.forbrukerradet.no/wp-content/upl…
p95+99: fil.forbrukerradet.no/wp-content/upl…
@thezedwards @NOYBeu We observed 70 firms receiving data from the makeup app Perfect365, including data brokers Fysical (claims to have 'human movement data on 25% of the population') & Safegraph (claims to track the location of 35m devices).
p34: fil.forbrukerradet.no/wp-content/upl…
p83: fil.forbrukerradet.no/wp-content/upl…
p34: fil.forbrukerradet.no/wp-content/upl…
p83: fil.forbrukerradet.no/wp-content/upl…
@thezedwards @NOYBeu Overall, we observed the 10 apps sending more than 88000 http requests to 216 hosts, owned by at least 135 companies.
Several third-party companies received data from multiple apps. Knowing just when and how often people use certain apps is enough to create personal profiles.
Several third-party companies received data from multiple apps. Knowing just when and how often people use certain apps is enough to create personal profiles.
@thezedwards @NOYBeu Our findings include many interesting details. Check @finnmyrstad's summary for an overview:
Some background info:
Summary:
consumerreports.org/privacy/popula…
In-depth articles NYT+TechCrunch:
nytimes.com/2020/01/13/bus…
techcrunch.com/2020/01/14/dat…
Some background info:
Summary:
consumerreports.org/privacy/popula…
In-depth articles NYT+TechCrunch:
nytimes.com/2020/01/13/bus…
techcrunch.com/2020/01/14/dat…
@thezedwards @NOYBeu @finnmyrstad The examined apps transmitted data to many widely unknown data firms, but also to well-known tech giants. Most apps transmitted data to Google+FB.
➡️Also, FB received accelerometer/gyroscope sensor data, and Amazon received GPS coordinates 🤔
p15+35+52: fil.forbrukerradet.no/wp-content/upl…
➡️Also, FB received accelerometer/gyroscope sensor data, and Amazon received GPS coordinates 🤔
p15+35+52: fil.forbrukerradet.no/wp-content/upl…
@thezedwards @NOYBeu @finnmyrstad Advertising firms and data brokers often claim to share only 'anonymized' data, which is usually a lie. In most cases, they use personal identifiers to combine profile data across many companies.
Google's so-called 'Advertising ID' is key to track and follow Android app users.
Google's so-called 'Advertising ID' is key to track and follow Android app users.
@thezedwards @NOYBeu @finnmyrstad The 10 apps examined transmitted the 'Advertising ID' to 70 companies.
This ID is then used across the surveillance marketing ecosystem and tied to data on our interests+behaviors.
They may sound a bit boring, but IDs are *key* for everything else.
p29: fil.forbrukerradet.no/wp-content/upl…
This ID is then used across the surveillance marketing ecosystem and tied to data on our interests+behaviors.
They may sound a bit boring, but IDs are *key* for everything else.
p29: fil.forbrukerradet.no/wp-content/upl…
@thezedwards @NOYBeu @finnmyrstad We also observed that many companies create their own proprietary identifiers. 13 firms received identifiers such as IP addresses and WiFi SSIDs. Many firms received detailed device metadata, which can be used for fingerprinting. Also, location data can be used to match profiles.
@thezedwards @NOYBeu @finnmyrstad It's impossible to observe how companies further share personal data between their servers. But:
We observed 19 firms receiving data via Grindr. One of them potentially further shares data with 170 partners. Again, one of those potentially further shares data with 4259 partners.
We observed 19 firms receiving data via Grindr. One of them potentially further shares data with 170 partners. Again, one of those potentially further shares data with 4259 partners.
@thezedwards @NOYBeu @finnmyrstad And take a look at the sections on 'cascading data sharing through Grindr'. It was hard work to understand and document how all those data companies interact, without being able to see what is happening on their servers.
p123: fil.forbrukerradet.no/wp-content/upl…
p23: fil.forbrukerradet.no/wp-content/upl…
p123: fil.forbrukerradet.no/wp-content/upl…
p23: fil.forbrukerradet.no/wp-content/upl…
@thezedwards @NOYBeu @finnmyrstad Like Google, Facebook, Amazon and other well-known companies, Twitter doesn't only act as a consumer-facing platform, but also as a 'third party'.
In case of Grindr, we observed Twitter's subsidiary MoPub playing a key role in personal data sharing with yet other data companies.
In case of Grindr, we observed Twitter's subsidiary MoPub playing a key role in personal data sharing with yet other data companies.
@thezedwards @NOYBeu @finnmyrstad In response to our report, Twitter's MoPub suspended Grindr from its ad network today.
But this is hardly enough. First, MoPub cannot merely shift responsibility to the app vendor. Second, MoPub claims to serve 49,000 apps, tracking 1.5 billion devices.
adage.com/article/digita…
But this is hardly enough. First, MoPub cannot merely shift responsibility to the app vendor. Second, MoPub claims to serve 49,000 apps, tracking 1.5 billion devices.
adage.com/article/digita…
@thezedwards @NOYBeu @finnmyrstad But MoPub is not alone. Take a look at this ad request to OpenX, a data company that claims to have relationships with 50,000 apps.
OpenX received GPS data via Grindr, and data related to real-time bidding ('openrtb').
p140: fil.forbrukerradet.no/wp-content/upl…
p28: fil.forbrukerradet.no/wp-content/upl…
OpenX received GPS data via Grindr, and data related to real-time bidding ('openrtb').
p140: fil.forbrukerradet.no/wp-content/upl…
p28: fil.forbrukerradet.no/wp-content/upl…
@thezedwards @NOYBeu @finnmyrstad We know how real-time bidding in today's digital advertising works in theory. Every time people visit a website or use an app their profile data is being sold to the highest bidder. It's been called a massive data breach, happening millions of times a day.
@thezedwards @NOYBeu @finnmyrstad Now OpenX, who received data related to RTB via Grindr, *recommends* publishers to send the Advertising ID, GPS coordinates and other kinds of personal data, and thus broadcast it across the data economy.
All parties involved must be held accountable.
docs.openx.com/Content/develo…
All parties involved must be held accountable.
docs.openx.com/Content/develo…
@thezedwards @NOYBeu @finnmyrstad They are not. And this is why our report is titled 'Out of Control'.
There is no way for users to understand how personal data is being shared when using those apps.
Unfortunately, I'm pretty sure the practices we observed are representative for the majority of Android apps.
There is no way for users to understand how personal data is being shared when using those apps.
Unfortunately, I'm pretty sure the practices we observed are representative for the majority of Android apps.
@thezedwards @NOYBeu @finnmyrstad Or, how @natashanyt puts it:
"Grindr is transmitting users' unique IDs, app name and precise locations to numerous ad tech companies, essentially broadcasting their sexual orientation to the entire consumer surveillance ecosystem"
Recommended thread:
"Grindr is transmitting users' unique IDs, app name and precise locations to numerous ad tech companies, essentially broadcasting their sexual orientation to the entire consumer surveillance ecosystem"
Recommended thread:
@thezedwards @NOYBeu @finnmyrstad @natashanyt Guidance for further examination:
- Don't only focus on the apps, but also on the companies who receive data (the reports contain many details)
- Don't only focus on clearly sensitive data, but also on systemic issues that look less obvious yet enable pervasive digital profiling
- Don't only focus on the apps, but also on the companies who receive data (the reports contain many details)
- Don't only focus on clearly sensitive data, but also on systemic issues that look less obvious yet enable pervasive digital profiling
@thezedwards @NOYBeu @finnmyrstad @natashanyt Some more stuff.
This is Bucksense. We observed them receiving Ad ID, IP and GPS data. The website of their ad platform Directopub (directopub.com/platform/) suggests they provide data to target age groups 'children', 'teens', and even 'infants' (?)
p135: fil.forbrukerradet.no/wp-content/upl…
This is Bucksense. We observed them receiving Ad ID, IP and GPS data. The website of their ad platform Directopub (directopub.com/platform/) suggests they provide data to target age groups 'children', 'teens', and even 'infants' (?)
p135: fil.forbrukerradet.no/wp-content/upl…
@thezedwards @NOYBeu @finnmyrstad @natashanyt What surprised me a bit is that so many companies received exact GPS location data - not in the US but in GDPR-land.
While some of them try to obfuscate how they utilize it, others openly present themselves as data brokers.
See e.g. fysical.com: 'BUY and SELL DATA'
While some of them try to obfuscate how they utilize it, others openly present themselves as data brokers.
See e.g. fysical.com: 'BUY and SELL DATA'
@thezedwards @NOYBeu @finnmyrstad @natashanyt We also observed an unidentified host receiving GPS location data via the Perfect365 app.
References in the requests point to location data brokers Fluxloop (Oslo) and Unacast (US). Either one or both may be responsible.
p38: fil.forbrukerradet.no/wp-content/upl…
p89: fil.forbrukerradet.no/wp-content/upl…
References in the requests point to location data brokers Fluxloop (Oslo) and Unacast (US). Either one or both may be responsible.
p38: fil.forbrukerradet.no/wp-content/upl…
p89: fil.forbrukerradet.no/wp-content/upl…
@thezedwards @NOYBeu @finnmyrstad @natashanyt In addition to location data brokers Fysical, Safegraph, Placer, Placed/Foursquare (as well as Fluxloop and/or Unacast), we also observed location data firm Tutela receiving GPS location +Wifi data, but were not able to attribute it to a certain app.
p72: fil.forbrukerradet.no/wp-content/upl…
p72: fil.forbrukerradet.no/wp-content/upl…
@thezedwards @NOYBeu @finnmyrstad @natashanyt So, our testing phone transmitted location data to quite some of the companies listed in this recent piece by @stuartathompson+@cwarzel on this '50 billion location records from 12 million phones' file obtained by the NYT.
Still curious about the source.
Still curious about the source.
