Twitter API Still Offers Enough Metadata to Reveal Where You Lived and Worked: Study

Twitter knows what you did last summer, at least before 2015. Sharing your location along with a small text was probably one of the biggest use cases of Twitter back in the days. When most users were tagging their location to their tweets, they didn't realise Twitter was capturing their exact coordinates. A group of international researchers have developed a tool using all that data that can determine where you live in just a few minutes with a high level of accuracy.

Before you jump off your chair or even raise your eyebrows, Twitter stopped collecting users' precise location data in April 2015. But all the previous tweets with location are still accessible via the company's official API. Users can still opt-in to share their GPS coordinates while sharing their location with tweets.

Researchers have developed a tool titled 'LPAuditor' (Location Privacy Auditor) that can find out a user's location with almost 90 percent accuracy. The tool uses data from Twitter's API, primarily from all the tweets from 2015 until 2009 (the year Twitter started the location service).

Even if you geo-tagged your tweet with "New Delhi, India", Twitter had your exact GPS coordinates which were included in your tweet's metadata. This information is still accessible via Twitter's API.

Now, a group of international researchers have written a detailed peer-reviewed paper that explains how LPAuditor uses Twitter's data to find out a person's 'most sensitive' locations. This includes places where people live, work, and spent most of their time.

Although Twitter claims it has always offered users the ability to delete their data, not everyone would prefer to delete their data, especially if they didn't know how much information was being recorded about them.

In their paper, the researchers have claimed they were able to analyse around 15 million tweets from almost 87,000 Twitter users. While some users had shared their specific location with their tweets, others had only shared a more broad area such as a city or a town.

LPAuditor could determine if a particular place was a user's residence by analysing the time spent at a particular location, the maximum number of tweets from the location, and other easily accessible data via Twitter API. It could apply the same logic to find out where a person works.

The research was based primarily on tweets posted before April 2015. While Twitter has changed its policy since then, there's still a good chunk of pre-2015 location data that is still accessible via Twitter's API, according to researchers.