Twitter has announced that it "inadvertently" used contact details collected for security purposes to identify users for advertising.
Data protection has become a minefield in recent years for large companies that collect and process user data. Data protection laws in the UK have always prohibited companies from collecting data for one purpose and then using it for another, but EU GDPR laws gave this law teeth by introducing massive fines for firms that breach data protection in this manner.
Twitter published a statement this week explaining that email addresses and phone numbers of users collected for account security purposes were "inadvertently used for advertising purposes." Twitter used the details to link twitter users to data provided by advertisers even if the user did not consent to their data being used for marketing purposes.
"When an advertiser uploaded their marketing list, we may have matched people on Twitter to their list based on the email or phone number the Twitter account holder provided for safety and security purposes," the statement explained. Twitter apologised for the error and stated that "As of September 17, we have addressed the issue that allowed this to occur and are no longer using phone numbers or email addresses collected for safety or security purposes for advertising."
Twitter does not appear to have directly contacted those affected and isn't treating this as a data breach, but under GDPR legislation it may constitute one as personal data was provided to third parties without consent. If data regulators rule that this is a data breach under GDPR, it will trigger an investigation that could result in fines of up to 4% of Twitter's global revenue.
Facebook was recently fined $5bn by the US FTC for data protection breaches relating to its misuse of user data for targeted third-party advertising as part of the 2016 Cambridge Analytica scandal.
Source: Twitter Statement
