3 ms·

> To add to what detaro was saying; even if explicit consent were required for sharing your location data, Deliveroo most likely got it; they after all need it

> To add to what detaro was saying; even if explicit consent were required for sharing your location data, Deliveroo most likely got it; they after all need it to know where your order is going to go. When such functionality is core to the app, an opt-out is not necessary. Per GDPR[0] consent must be specific. i.e. aquiring constent for a legitimate feature of an app and then also using the data for marketing purposes, what seems to be happening here, is not legal. Of course it could be the case that Deliveroo uses Braze for all their push notifications and thus consider it an essential part of their product. IANAL, but as I read the GDPR giving an app location access required for legitimate functionallity is not a carte blanche for the app to use location data for any purpose without obtaining consent for each specific usage. In any case, like you say it's extremely creepy and the level of accuracy is worrying. 0: https://gdpr-info.eu/issues/consent/ https://gdpr-info.eu/issues/consent/

scrollaway 8y ago
I just replied elsewhere in the thread regarding this. Consent to collect was acquired, but nothing actually says they're processing this data for marketing purposes if you haven't opted in to it. I've seen this pattern quite often: The opt in/out flag is stored somewhere and companies invalidate the data they have based on that in the marketing tooling itself; collection still happens regardless. I've not used it but it's even possible Braze has information on the optin/optout and the ability to immediately reject data about optouts. The reality is that, while the clean and intuitive privacy practices we're talking about are compliant, they're not required for compliance. Companies go the least-effort route. Deliveroo has clearly done a GDPR pass on their practices so I highly doubt they're using the data in question for marketing (even if they're collecting it). But I'm still encouraging you to go and talk to them about it. I promise you if you're polite and clear about what and where the issue is, you can likely get some changes done. It's pretty fulfilling, too :)

scrollaway 8y ago

I just replied elsewhere in the thread regarding this. Consent to collect was acquired, but nothing actually says they're processing this data for marketing purposes if you haven't opted in to it. I've seen this pattern quite often: The opt in/out flag is stored somewhere and companies invalidate the data they have based on that in the marketing tooling itself; collection still happens regardless. I've not used it but it's even possible Braze has information on the optin/optout and the ability to immediately reject data about optouts. The reality is that, while the clean and intuitive privacy practices we're talking about are compliant, they're not required for compliance. Companies go the least-effort route. Deliveroo has clearly done a GDPR pass on their practices so I highly doubt they're using the data in question for marketing (even if they're collecting it). But I'm still encouraging you to go and talk to them about it. I promise you if you're polite and clear about what and where the issue is, you can likely get some changes done. It's pretty fulfilling, too :)