It doesn't sound like they do - from their whitepaper https://www.predictwise.com/whitepaper:

> PredictWise has collected hundreds of thousands of respondents reporting party identification and models voters through survey, mobile data, and location data compiled through mobile devices

> PredictWise’s database includes verified data on 50 Million+ unregistered voters, sourced through credit files and portal registration data (e.g. Crate&Barrel), and is carefully purged of duplicates or registered voters, updating daily. PredictWise (PW) machine learning models predict the party of unregistered based on survey respondents from hundreds of thousands of Americans and can apply support scores to turnout your electorate.

> We make full use of the probability models on the file, ensuring that each individual will get a score reflecting his or her exact position. The end result is a continuous score for each cluster ranging from 0 to 100 for every American represented on the file.

So, they have a few hundred thousand survey fills/app installs. Then they combine the data against 50 million public records, and then they extrapolate it out for the entire voter population. So they may have one or two given devices in an area and then their model says what that represents across everyone.

I was under the impression that e.g. phone carriers in the US fairly freely sell that kind of data to whoever pays for it, and can do so legally except for less than a handful of states states with useful general privacy regulations? (general in contrast to sector-specific ones like HIPAA)

This is either cell carrier data or data that is gathered from those "free" apps and games people love to install and grant all permissions to.

There are several ways I can think of.

First, people were willingly installing COVID-19 contact apps to alert them if they were in contact with a confirmed-positive case. Despite all of “us” (security-paranoid people) shouting at the top of our lungs that This Is A Bad Idea.

Second, your phone is constantly listening to a list of SSIDs and bluetooth identifiers to connect to and broadcasts a small amount of info - like your MAC address -, which can uniquely fingerprint your device. Supermarkets, for example, have used this for years to track shoppers. They can easily track your phone without GPS just by listening what it broadcasts and where from. And it is also then not a surprise when Apple decided to remove the functionality to turn off WiFi and Bluetooth from the “drawer” and instead of for it to only “disconnect from nearby networks until tomorrow.”

Here is the article about WiFi and retail stores https://lifehacker.com/how-retail-stores-track-you-using-you...