A breakdown of all the data tech companies can collect during a low-key pizza and movie night with a friend, according to their privacy policies
The smartphones, Facebook accounts and other technology products deeply embedded in modern life help people get more things done every day.
Context & Ripple Effects
This WSJ walkthrough was published weeks before GDPR took effect, and it reads differently now: it catalogued what companies like Facebook and smartphone makers said they could collect from a single ordinary evening at home. The follow-on reporting showed the disclosed policies understated reality — apps were later found shipping heart-rate and pregnancy-intent data to Facebook through its analytics SDK, and Facebook had granted deeper device-maker access through private APIs than its public disclosures implied.
First-order effects
- Consumers get a concrete map of how one low-key night — phone in hand, movie streaming, group chat open — triggers collection across location, viewing choices, and social graph under existing privacy policies.
- Facebook and the device and app makers named in the piece face immediate scrutiny over the gap between what their policies permit and what users understand they're agreeing to.
Second-order effects
- When journalists tested how companies honor data rights, responses across 30+ firms proved opaque and inconsistent, pushing regulators toward the GDPR-style rules then taking shape.
- The opacity of policy-based consent fed proposals for a central custodian of personal data — a government or Apple-like fiduciary holding data on users' behalf rather than scattering it across dozens of policies.
Third-order effects
- As platform-level collection gets regulated, the industry's center of gravity shifts to first-party gathering: marketers now run quizzes and events to rebuild the profiles Big Tech policies no longer hand them (marketers' first-party workarounds).
- Meanwhile the raw material keeps flowing through channels users never see — brokers like Thasos lease GPS coordinates from roughly 1,000 apps and sell the insights downstream (Thasos's anonymized-location trade) — meaning policy transparency alone doesn't constrain the secondary market.
The trend: Consumer data collection is migrating from something disclosed in privacy policies to something governed by regulation, intermediaries, and SDK plumbing — with each layer of scrutiny pushing collection into less visible channels.