Global site tag (gtag.js) - Google Analytics

ProTip: if you’re using a phone app you’re online!

Here’s an example. A third-party advertising company called MoPub, owned by Twitter, provides the technology that app developers use to collect and share data. This includes the user’s age and location tied to a device ID, which in turn allows trackers to match that information to a real identity. Apropos of recent news, Grindr is just one of over 55,000 apps using MoPub to collect and share data.

MoPub operates in the vast, convoluted, opaque ecosystem of personal data collection and sharing that powers modern adtech. To understand how that ecosystem works and where Grindr and MoPub fit in, we need to talk about real-time bidding or RTB.

RTB is the automatic, milliseconds-long data-sharing frenzy that occurs whenever you see a third-party ad on one of your devices. First, an app developer, like Grindr, decides it wants to monetize its app. To do so, it partners with a Supply-Side Platform (SSP) like MoPub. 

SSPs are companies that app developers and website publishers hire to sell their advertising space. When you install the Grindr app on your phone, part of what you get is a big chunk of code from MoPub, called a software development kit (SDK). After some initial configuration, Grindr leaves the details of sharing data and serving ads up to MoPub.

Let’s take a closer look.

When a user opens the Grindr app, code from the MoPub SDK kicks into action. The process looks like this:

1. The SDK gathers as much data as it can about the user’s phone. This may include the phone’s advertising ID, its precise GPS-derived location, and data from Grindr itself, like age and gender. The app directs the user’s phone to send all this information to MoPub.

2. MoPub links the data it got from Grindr with what it knows about the user from other sources. This includes the 55,000 other apps that use MoPub, such as The Weather Channel app, Ubisoft games, and

3. MoPub packages this data into a “bid request,” a standardized dossier about the user that includes device ID, location, gender, age, and interest keywords.

4. MoPub sends the bid request to dozens or even hundreds of demand-side platforms (DSPs). DSPs are companies that advertisers hire in order to target and serve their ads, such as Criteo, Rocketfuel, and AppNexus. You may not have heard of them, but those and hundreds of other DSPs have probably handled a lot of your personal information. MoPub partners with over 130 different DSPs, listed here.

5. Each DSP that receives the bid request can link the included device ID to its own profile of the user, or purchase additional information about the user from data brokers like LiveRamp.

6. Each DSP submits a bid to serve an ad to that particular user at that particular time.

7. MoPub determines the winning bidder and notifies all participants in the auction.

8. The winning advertiser serves its ad to the user’s phone. Often, the ad itself allows the advertiser to collect even more information directly from the device.

All of this happens in a fraction of a second. MoPub boasts that its software reaches over 55,000 apps and 1.4 billion devices worldwide. So yeah, you have no privacy online.

Michael Conlin

Michael Conlin​

Chief Technology Officer​
Phone: (703) 216-5856​​

Suggested content for you