Kaufland builds a detailed digital identity profile from roughly 200 different device characteristics and sends your shopping, payment and customer data over both US and Chinese infrastructure, including Huawei systems subject to China's intelligence law, without disclosing this in the privacy policy. A Huawei device identifier is also fed into a third-party marketing analytics tool, and the app quietly links your Kaufland payment behaviour to your Disney+ subscription status, all before you have given consent. A debug logging tool once flagged in this app has since been independently re-checked and found inactive in the current release.
com.kaufland.Kaufland. Kaufland GmbH & Co. KG, Neckarsulm (Schwarz Gruppe, EUR 135B revenue, 1,500+ stores, 8 countries, Europe's largest retail group). C1: 2x Firebase API Keys (AIzaSyAXhN77…) + Google Maps Key (AIzaSyCCAiny…) + production DB kaufland-app-android.firebaseio.com hardcoded. C2: LexisNexis ThreatMetrix device fingerprinting, TMXProfilingHandle + TMXStrongAuth: ~200 device parameters aggregated into a "Digital Identity" profile on an app handling self-scan, Kaufland Pay and loyalty data; US transfer with no Art. 44-49 GDPR mechanism, not named in the privacy policy. C3: Huawei HMS Location (560 smali classes) + Huawei Ads + PushReceiver, EU purchasing-behaviour data routed through Chinese infrastructure, Huawei falls under China's National Intelligence Law Art. 7, no Art. 44-49 GDPR transfer mechanism. H1 RETRACTED 2026-10-02: independent re-verification against the current build (v6.18.0, sha256 d9a7692800419b20602fe867d5801556704b66a92d1579c870e8466c5df0cb5) found zero functional Chucker interceptor classes, only the public no-op API surface - this finding is withdrawn for the current build. H2: BlueCodeDisneyPlusManagerImpl, undisclosed cross-platform data sharing: Kaufland payment behaviour linked to Disney+ subscription status (The Walt Disney Company, USA), no Art. 28 GDPR data-processing agreement identifiable; Kaufland's own cited Ziffer 6.14 clause names reseller Lidl Content GmbH but never names Disney or Disney+. New 2026-10-02: the Huawei OAID identifier (distinct from AAID) is routed into the Adjust attribution SDK via a company-authored wrapper (OaidLogger), not addressed in Kaufland's own reply and not disclosed as a separate processing activity. + Firebase + Huawei AAID + Adjust + 2x Optimizely pre-consent/BOOT_COMPLETED, READ_CLIPBOARD, Klarna, Storify reserved. R1 sent 2026-06-30. DSB + EDPS + LfDI BW in CC. Embargo 2026-09-28. Deadline 2026-07-14. Eleven messages over 94 days drew two adversarial replies demanding deletion of the public record; after independent re-verification one finding was retracted, one new finding was confirmed and the rest stayed disputed, and Kaufland declared the correspondence closed without answering the final three questions. Case closed and published 2026-10-17, 19 days after the 2026-09-28 embargo.
click to expand