Twitter admits to more bugs that shared your data without permission

Twitter said it has fixed two more bugs related to how it uses personally identifiable information to target personalized ads on the platform.

The flaws mean the social media service may have inadvertently shared your data with advertising partners even if you had explicitly not granted permission to do so.

To that effect, the company said it “recently” found issues where users’ choices in the service’s settings may not have been honored, resulting in certain data like “country code, if you engaged with the ad and when, information about the ad” shared with its advertising partners.

This transpired only if a Twitter user clicked or viewed an ad for a mobile application and subsequently interacted with the mobile app, it said.

How Startup Amsterdam Boosts Innovation and Growth at TNW Conference

Discover how the City of Amsterdam partnered with TNW to amplify its startup ecosystem, attract global talent, and foster innovation that drives economic impact.

Read the case study

The company acknowledged the leak has been happening at least since May 2018 — right around the time GDPR data protection regulations went into effect in the EU.

We recently discovered and fixed issues related to your settings choices for the way we deliver personalized ads, and when we share certain data with trusted measurement and advertising partners. We want to share more context around this with you: https://t.co/jDn5zeWVwU

— Twitter Support (@TwitterSupport) August 6, 2019

The disclosure comes months after the microblogging site fixed a similar bug that gave away a user’s approximate location information to an unnamed Twitter partner.

It also disclosed a second bug that concerns tracking users for serving relevant ads. The issue, since September 2018, may have shown you ads based on inferences drawn from the devices you use (mobile apps and browsers), regardless of your consent.

The company said it fixed both the bugs on August 5, although it didn’t explicitly state how many users were affected.

“We are still conducting our investigation to determine who may have been impacted and If we discover more information that is useful we will share it,” Twitter said.

The situation sounds like a violation of GDPR requirements, which mandates that companies seek users’ explicit permission before tracking them or processing their personal data.

Twitter admitting it went ahead and processed them anyway — if only accidentally — raises serious questions about consent. Inadvertent or not, what this amounts to is a clear breach of users’ preferences and privacy.