Thread by @WolfieChristl

So both OkCupid (according to what we observed: fil.forbrukerradet.no/wp-content/upl…) and Tinder's new 'safety' app (according to: gizmodo.com/tinders-new-pa…) share personal data including device IDs with Kochava, a massive data broker who claims to gather data from '7 billion devices globally'.

This is what we observed. It's not about detailed profile data, yet Kochava still receives data about the fact that someone uses the app, when and for how long ('uptime'), plus device metadata, linked to personal identifiers such as Google's 'Advertising ID' and a proprietary ID.

Kochava openly sells data to other companies, for example, they 'deliver' access to 'mobile device IDs and accompanying data elements', including but not limited to data on interests, behaviors and devices:
kochava.com/data-marketpla…

When Gizmodo's @swodinsky asked whether Tinder's 'safety' app worked with adtech companies, they denied they worked with any at all.

When she confronted them with the findings, they said they use Kochava 'only' for 'attribution' and do not receive 'personally identifiable data'.

@swodinsky Which is at least misleading, because data linked to device IDs clearly refers to individuals and can be used to track and follow them across the digital world. And it is clearly 'personal data' as defined in the GDPR.

'Attribution' is a typical part of tracking-based marketing.

@swodinsky Is data from OkCupid and Tinder's 'safety' app included in Kochava's so-called 'Collective' data?

Whether or not, Kochava says it has 7bn devices 'under management'. They claim to track 1.3bn users, and their software is part of 'more than 10,000 apps'.

kochava.com/data-marketpla…