Retest Observations

We retested this app on 19.02.2019. The app still exhibits the behaviour documented below.

Disclaimer: Additionally the tested app may still share data with other third parties. This is outside the scope of this work.

Read more

Yelp is an app for finding local amenities and services

From the Google Play Store page:

"Yelp has over 135 million restaurant and business reviews worldwide. Whether you’re looking for a new pizzeria, a great coffee shop nearby, a new salon, or the best handyman in town, Yelp is your city guide to finding the perfect places to eat, shop, drink, relax, visit and play. "

Observed Behaviour

 This documentation demonstrates actions taken by the test user and the apps subsequent responses.

Test user action 1: The user taps on the application icon, which opens the application
Response from app: The application is initialised and the following data is sent and received by the app:

Immediately after the app is opened, the following data is sent to (Graph)

The following GET request was made:


With the response

  "supports_implicit_sdk_logging":true,"gdpv4_nux_enabled":false,"gdpv4_chrome_custom_tabs_enabled":true,"android_sdk_error_categories":[ {
    "name":"login_recoverable","items":[ {
    , {
    ],"recovery_message":"Please log in to this app again to reconnect your Facebook account."

Without any further user action, the app sends the following request to

format:                       json
sdk:                          android
event:                        MOBILE_APP_INSTALL
advertiser_id:                474364c6-e9cf-4971-8dd2-b1dc3c605450
advertiser_tracking_enabled:  true
anon_id:                      XZ4e0f5a61-8cf9-40fe-93b4-67126270f77e
application_tracking_enabled: true
extinfo:                      ["a2","",21030003,"10.31.0-21030003","8.1.0","Nexus 5","en_GB","GMT","",1080,1776,"3.00",4,13,8,"Europe\/London"]

The app receives the following response from


Test user action 2: The user makes further interaction with app
Response from app: No futher data is sent to

Test user action 3: The user closes the application
Response from app: No futher data is sent or received by the app from



Notes and Commentary

Note 1: In the videos below, the clocks between the VirtualBox Virtual Machine and the Phone handset are not synchronised.
Note 2: The phone videos are split into multiple parts due to a 180 second limitation in Android Developer Bridge screenrecord command

Date Tested
App Version
Number of App Installs (according to Google Play Store at time of analysis)
Facebook SDK Version
Opt out of Ads Personalisation (Google Settings)
Not Enabled (Default Setting)