They also have access to a lot of other metadata (IMEI, IP address, OS version, MAC address, email/phone number that you signed up with, etc) that they could combine with data from brokers to identify you as well.
I'm not saying that they should be collecting this data, to be clear, just that, from everything I've read, it doesn't seem like they are doing anything uniquely untoward. I'm hoping there's something I'm missing.
