There's a reasonable amount of information you can ask for to target ads, then there is too much, and too specific -- and then it become dangerous.
I dont see the use in sending the device ID to an advertiser. At best it's bad coding. They could easily make up their own ID for you not tied to the deivce ID, or at the very least some cryptographically hashed and salted derivative of the device ID (still not good, but better than the actual ID). Birthday is a bit sketchy as well. Birth year (ok), or age group (even better) would be more aggregate and should suffice for ad targeting. As would Network (coarse) location instead of GPS.
It's one thing for your phone company to know your GPS history for the past few years but what happens when some 3rd party company you've never heard of has that information?
I think it's perfectly reasonable to hold Pandora's feet to the fire on this one.