5 ms·
It might be interesting to someone that GitLab is not seem to be compliant with current European data regulations (GDPR), it is worth reading their terms and pr
by a_imho 8y ago
It might be interesting to someone that GitLab is not seem to be compliant with current European data regulations (GDPR), it is worth reading their terms and privacy statements [1][2]. E.g. even self hosted GitLab phones home in opt-out fashion.
GitLab collects information about usage from each self-hosted GitLab instance (Community Edition and Enterprise Edition) through a usage ping. The usage ping sends a payload containing data such as total number of projects and pipelines, as well as license information and hostname to GitLab.
...
The information from the usage ping is not anonymous, it is linked to the hostname of the instance [3]
...
The documentation is a merge request [4]
This MR loads the EE usage ping asynchronously on the admin application settings page and now includes the counts of the following items:
Comments
Groups
Users
Projects
Issues
Labels
CI builds
Snippets
Milestones
Todos
Pushes
Merge requests
Environments
Triggers
Deploy keys
Pages
Project Services
Issue Boards
CI Runners
Deployments
Geo Nodes
LDAP Groups
LDAP Keys
LDAP Users
LFS objects
Protected branches
Releases
Remote mirrors
Web hooks
[1]https://about.gitlab.com/privacy/ https://about.gitlab.com/privacy/
[2]https://about.gitlab.com/terms/ https://about.gitlab.com/terms/
[3]https://docs.gitlab.com/ee/user/admin_area/settings/usage_statistics.html https://docs.gitlab.com/ee/user/admin_area/settings/usage_st...
[4]https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/735 https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/735
- icebraining 8y agoRemember that the GDPR only applies to personal data. That is defined rather broadly, but it still might not apply to all the information you've mentioned.
- a_imho 8y agoIn the EU IP alone could be considered PII, it would seem logical that hostnames are too, but I never saw it spelled out. The counters are sent in combination with these identifiers. The summary above is compiled from GitLabs own sources. Most probably don't care but some might.
- merb 8y ago> In the EU IP alone could be considered PII that statement is wrong. first of all IP Addresses are only PII if you store them to identify users, means that if you are user table has an ip_address field, it is, however... if you store all ip's accessing your service in a database to find malicious logins it isn't. so basically the statement is, it depends. the connection of user to ip makes it PII.
- deleted 8y ago[deleted]
- a_imho 8y agoI think we agree context is important. However GitLab is collecting IPs in combination with hostnames, not to mention the rest of the traffic that could easily be used to fingerprint users.
- jhurewitz 8y agoGitLab obtains affirmative consent to its use of personal data under privacy policy, plus users also have the ability to opt out if they wish revoke their acceptance.
- a_imho 8y agoGitLab offers a blanket checkbox on signup with a bunch of legalese, there is no fine grained opt-in to the data collected. Worse, as you said, it is all opt-out.