Pandora Provides Detailed Data, Including GPS Coordinates, to Advertisers
It took a look at the Android version of Pandora's streaming music app, and found that it was feeding data to five different advertising platforms: AdMarvel, AdMob, comScore, Google.Ads, and Medialets. It appears the Pandora is feeding GPS coordinates, as well as the user's birthday, gender, postal code and Android ID, to AdMob. The other ad networks received similar data -- with comScore pulling in Android IDs, and Medialets receiving very detailed GPS data, including bearing and altitude, as well as information about model and version of Android.
When contacted, Pandora refused to comment. But, if Veracode's analysis is correct, the company could face serious legal issues in the coming months. We're accustomed to apps and websites collecting data about us to provide targeted advertising, but generally we expect that data to be kept anonymous, and for companies to be upfront about the information they gather. Many of the developers being subpoenaed in New Jersey are providing information that could easily be used to build a complex profile about a person, including where they go, where they work and with whom they associate -- all without providing clear notice to the user. We think Veracode's Tyler Shields said it best: "That feels a little Orwellian to me."