Thread by @WolfieChristl

2 years ago, we observed Grindr sharing exact location data with 8 data brokers in the 'advertising' space, including MoPub, back then owned by Twitter.

Now the WSJ found that this data has actually been available for sale, via MoPub, since at least 2017:
wsj.com/articles/grind…

In 2019/2020, we examined how Grindr secretly shares data with third parties, led by the Norwegian Consumer Council, together with @thezedwards, Mnemonic and @NOYBeu.

Here's a chart showing the data flows from Grindr to third-party companies we observed:

https://twitter.com/WolfieChristl/status/1217051502034018306

Based on the GDPR complaints we filed, the Norwegian data protection authority started an investigation, and then fined Grind almost €7 million for sharing personal data with third-party companies without a legal basis in 2021:

https://twitter.com/WolfieChristl/status/1354019977825808387

https://twitter.com/airavn/status/1471095852206804998

For example, we observed Grindr sharing sensitive personal data including device identifiers, exact GPS coordinates and information about the fact that the data comes from a Grindr user with MoPub, which facilitated further data sharing with yet other third-parties, and so on.

According to its terms, MoPub reserved the 'right' to share the data with 170 partners. One partner claimed to share it with another 4259 partners …this is why our report was titled 'Out of Control'.

In 2019, MoPub's partner list also included UberMedia:
web.archive.org/web/2019060623…

We assumed the shared data is widely available on today's opaque personal data markets, but couldn't find solid evidence.

Now the WSJ found that UberMedia (UM) is one of the data brokers who bought and sold data on Grindr users obtained via MoPub, according to anonymous sources.

Twitter doesn't deny MoPub's data sharing, but told the WSJ it had contractual restrictions in place. Sure!

UberMedia's new owner also doesn't deny the data sharing, and just told the WSJ that "every single entity in the advertising ecosystem has access to the information" 🤡

And even worse, UberMedia data was "at the time being used by federal government contractors in national-security programs, and people working on those projects saw large amounts of Grindr data, according to people familiar with the matter".

Relax, it's just digital advertising!

But the data didn't contain names! Data companies always say that and it's just totally pointless.

The data we observed Grindr sharing contained unique device IDs, so-called 'Advertising IDs', which can be used to link digital profiles on a person across thousands of databases.

Almost certainly, UberMedia obtained and sold Grindr data including linkable device IDs, which can be used to monitor, follow and target people across the digital world.

This is at least what their docs suggested in 2019/2020:
web.archive.org/web/2020103018…

https://twitter.com/WolfieChristl/status/1282779059982929922

And even if the data would not include *linkable* device IDs, it is trivial to infer a person's home address, workplace and other patterns from GPS location data, and then automatically cross-link it with other information available from data brokers.

It's just personal data.

Obviously it's sensitive personal data.

In 2021, an ugly conservative outlet bought commercial location data to spy on years of the life of a high-ranking catholic priest, out him and make him resign, framing homosexuality as 'sexual misconduct'. They claimed it was Grindr data.

Back then, Grindr "said it didn’t believe it was the source of the data but acknowledged it was theoretically possible that an advertising partner might have collected it", according to the WSJ.

Of course, other fanatics or governments across the world may have also bought it.

What's sensitive depends on the affected person and context.

Many if not most apps share personal data with third parties. Most people are not even aware of the scale and depth of uncontrolled data sharing that is the basis of today's surveillance advertising.

This must end.

Grindr claims it has now "cut off the flow of location data to any ad networks, ending the possibility of such data collection today", according to the WSJ.

...perhaps as a consequence of the €7m fine in Europe, a quite large share of Grindr's revenue.

This is the way to go.

I cannot verify if this claim is true.

According to @ExodusPrivacy, Grindr still includes data-harvesting code from Google, FB, Amazon, AppsFlyer/Salesforce, Fyber, Vungle, PubNative, Braze, and from AppLovin, who recently acquired MoPub from Twitter:
reports.exodus-privacy.eu.org/en/reports/com…

@ExodusPrivacy Uncontrolled data sharing cannot be the basis for our future digital economy and society.

The only way to fix this mess is regulation plus effective enforcement, not least because apps+services increasingly share data directly, which is not observable from outside their systems.

If we want to have services that rely on data on our everyday lives to provide us with useful functionality in the years to come, if we want everyone to participate in info society, and THIS IS WHAT WE WANT, we must be sure that data-processing entities do not misuse their power.

This means surveillance marketing as it exists today must cease to exist. Apps, device vendors and other digital service providers must - and will - find other business models.

To achieve that they must know that their business may cease to exist if they misuse their data power.

In GDPR land, the law had already been providing ways to make that happen since 2018, if only it was effectively enforced against apps, service providers, data brokers, and tech oligarchs.

What if other European regulators would finally follow the small, brave Norwegian DPA…

Anyway, even if well-enforced, the ambiguity of a technology-neutral law that requires case law developing over years is perhaps too slow for a 'move fast and break things' industry. I'm afraid the DSA's rather weak provisions on surveillance marketing are a wasted opportunity :/

In the US and in other regions on the planet the situation is even worse. But really, the law is the only way unless you want to drive digital technology and information society to the wall.

And forget 'notice' and #darkpattern 'choice'.

Let's start shaping tech, as a society.