Privacy Policy Deep Dive: Tumblr Live
Or, how I learnt to stop worrying and love the cyber dystopia
If you were a teenage emo or nerd in the early to mid 2010s, you almost certainly used Tumblr - a blogging platform with a small user base compared to the social media heavy hitters, but popular due to being less image-focused than Instagram and TikTok, more long-form than Twitter, and not Facebook just in general.
Recently, it has implemented a feature called Tumblr Live, following in the footsteps of the likes of Facebook Live, Instagram Live, and Twitter Live (all of which do exactly what they say on the tin). This has been a controversial update, not least because of the fact you cannot turn this feature off, only “snooze” it for 7 days, after which it will pop right back up again.
Well, I say “you”.
I mean “people located in the USA”.
Tumblr Live isn't available anywhere else in the world, specifically not Europe and even more specifically not the UK (relevant because I live here). Is this just a gradual rollout? It's very common for only a few users to receive features at a time, to ensure all the new parts work with the existing software. Or is it, as the old saying goes, not available in Europe because it's such an incredible breach of GDPR that you might as well hand over your bank details right now to that nice Nigerian prince emailing you.
Make your guesses now.
Getting started
When opening Tumblr Live, this popup is the first thing you're greeted by.
Or at least, that's what the FAQ says. Again, not available outside the US.
The logical place to start here is Tumblr's own Privacy Policy. Well, the US one - there’s a separate one for the EU and UK, which is already a bit of a red flag and we haven’t even opened anything yet.
I'm not going to go through the entire policy in detail, because this blog is focusing on Tumblr Live rather than the social media platform in general. They gather all sorts of data on you (see the list below) for analysing, making changes to the service, giving to the police if they ask, and, of course, targeted advertising.
Thanks to laws in California, Colorado, Connecticut, Utah, and Virginia, they even provide a list of all the data they collect! Honestly, it's nothing too unsurprising from a social media site, and at least they don’t track you across different sites too.
My god but the bar is on the floor.
Here's the list:
Personally, I'm a fan of the line “Inference data about you”, because that tells us a grand total of nowt all about what they actually collect, and also because it serves to reaffirm the fact that we can literally never win.
And, speaking of never winning, Tumblr takes the time to assure us that (and I quote) they “try to work only with those Third Party Services that share [their] respect for your privacy”.
So, surely, everything will be fine from here on out.
The Meet Group?
The Meet Group are a livestreaming video provider, who have their own video apps, as well as various business partners who use their services. Their Privacy Policy linked on their site refers to MeetMe, a service owned and operated by them, but despite this is, as far as I can tell, used as the Meet Group's general Privacy Policy.
We'll start with what data they collect!
Oh Jesus that's a lot of words.
Most of the key parts are in bold. Some non-bold key parts are how, if you sign in to MeetMe with Facebook, they will use your email address, hometown, gender, profile photo, date of birth, friends list and userID from it. They will also collect information about location on a device level, even if you've switched off sharing location on your MeetMe profile!
Something else to point out is the bit about “biometric data”, right near the bottom. MeetMe wants this to verify your account - an entirely optional action, it must be said. Now, this information isn’t sold or used for marketing purposes, and will usually be deleted after 30 days, but it will be transferred if another business buys the Meet Group, or if law enforcement asks for it.
I do not want any of those groups to have my biometric data.
Speaking of non-marketing data, biometrics is not the only one they won’t sell. It’s on a (pretty short) with exact date of birth, first and last name, address, phone number, and email.
Everything else, though, is fair game.
Lots of the uses are similar to Tumblr (and… the internet at large). Targeted adverts run by others, contacting you, and marketing for MeetMe's own ad campaigns. Other uses include, but are definitely not limited to, development & testing, customising user experience, research, managing the company, and a fun little thing they call “profile display and sharing”.
None of this, despite my earlier joke, infringes on GDPR. They actually have an entire section dedicated to European Economic Area residents detailing how to exert the rights GDPR gives you with regards to the data they’ve collected on you.
Holy law-abiding corporation, Batman!
What they mean by this “profile display” is neatly summed up below:
Their current partners are Skout (another live video provider), and Plenty of Fish, Zoosk, Chispa, and Badoo (all dating sites/apps). Flurv, an app owned by the Meet Group, is a social network designed to find people in your local area, and Boy Ahoy is the same but aimed at gay men.
This paragraph translates to “we will show your information, and the fact you're streaming live, to users of all of these entirely unrelated apps, oh!, and you can't turn it off”
Now, personally, I don't want my hypothetical personal information and livestream to be shown to the users of a whole bunch of random dating apps, but maybe that's just me.
Not illegal, but I don't like it.
In conclusion
I can safely say that nothing I've read has filled me with any sort of love towards Tumblr Live. Granted, I haven't looked at any other streaming sites - but something tells me that having your profile broadcast out to the users of dating sites owned by the same company is not not for the course.
So maybe if you truly want to do a live performance to a bunch of strangers, save yourself some trouble and find a local open-mic night.