“Out of Control” A review of data sharing by 10 popular mobile apps (2020)

“Out of Control” A review of data sharing by 10 popular mobile apps (2020)

Key findings

1. All apps share user #data with multiple 3P

2. All but one share data beyond the device advertising ID: IP address and GPS position, personal attributes -gender and age-, and app activities like GUI events. This information can be used to infer attributes: sexual orientation or religious belief.

3. Tinder sends the user’s GPS position and information about age, gender, and target gender to LeanPlum and AppsFlyer and happn sends country, gender and age segment to #google

4. Grindr shares detailed user data with a very large number of 3P: IP address, GPS location, age, and gender. By using MoPub the sharing is highly opaque as neither the 3P nor the information transmitted are known in advance. MoPub can enrich the data that is shared with other parties dynamically

5. Perfect365 shares data with a very large number of 3P: advertising ID, IP address, and GPS position. The app appears to be built to collect and share as much user data as possible.

6. mydays GmbH shares the user’s GPS location with multiple parties, and OkCupid shares detailed personal questions and answers with Braze.

Norwegian Consumer Council “Out of Control” report