Thread by @fs0c131y

1. Hi @makemytrip 👋! Why are you retrieving user data without their consent?

Your #android app is making an http🤦‍♂️ request to metric.makemytrip.com with the following unencrypted 🤦‍♂️ data:
- email
- device name
- phone build version
- OS version
- network type
- ...

2. This is the nice tracker package you have here...

3. You can find the definition of the Events and FNKeys they used: gist.github.com/fs0c131y/065c7…

It seems they used to retrieve the Client_IP, Gender, Last_Name and more

4. In Europe, IP address is consider as a personal data. According to #GDPR you need to allow user to opt out from this data collection. You have until May to be compliant...

cc @CNIL

cc @AndroidAuth @AndroidPolice @androidcentral @androidandme @Androidheadline @xdadevelopers @AndroidSPIN @TheHackersNews @verge @CNET @VICE @WIRED @JAMESWT_MHT @malwrhunterteam @hackerfantastic @LukasStefanko @ANDROIDPIT @FigaroTech @virqdroid @twandroid

unroll