Potential privacy issues of Threads

Threads already has over 100 million active users¹. However, the app is still not available in the EU as it is not yet compliant² with the EU’s Digital Market Act (DMA)³. But what exactly are the potential privacy issues of this new Twitter rival? Surfshark’s privacy counsel Gabriele Kaveckyte took a deep dive into Threads’ privacy policy and uncovered its potential flaws.

Potential data privacy issues of Threads:

• Issue #1: Data may be collected with no legal basis. Threads collects sensitive information⁴, like racial or ethnic data, sexual orientation, and more⁵. In the EU, sensitive data can usually only be collected and used with a person’s consent⁶. However, it is unclear whether a proper legal basis is used for the collection of this data. The app also collects browsing history, health, and fitness data⁴. This information is likely shared within the Meta group and with third-party advertising service providers.
• Issue #2: Collected data is likely shared within the Meta group. Deleting a Threads profile requires deleting the linked Instagram account⁷, emphasizing their integration. The interconnectedness of Instagram and Threads enables better user experiences but raises concerns about data protection rights, such as the right to data deletion under the GDPR⁶. Additionally, having one more app in the pool of Meta apps (Facebook, Instagram, Whatsapp) might facilitate more accurate user profiling through increased data collection, potentially enabling precise predictions about user habits.
• Issue #3: Users may be unable to exercise their GDPR rights. If users did not register on Threads via Instagram (e.g., if they post on Threads through an integration with a third-party service), their requests to implement their rights under the GDPR and other laws might be dismissed⁷. This means that users might be unable to delete their data, get a copy of their data, or request information about how their personal data is used.

Methodology and sources

Surfshark’s privacy counsel Gabriele Kaveckyte analyzed Threads’ data collection practices and presented three potential privacy issues related to data collection and safety based on the GDPR.

References: