4 ms·

It's fine to collect telemetry. It's even fine for it to be active by default, so users have to opt-out, although not my preference. That isn't what we're discu

It's fine to collect telemetry. It's even fine for it to be active by default, so users have to opt-out, although not my preference. That isn't what we're discussing here. This telemetry is mandatory. Users are not permitted to opt-out.

jeroenhd 6y ago
Actually, any telemetry that, combined with other databases, can identify a single natural person located inside EU borders must be submitted with informed consent. This means that the average Joe must understand what information is being sent and the submission must be opt-out rather than opt-in. It's possible to do telemetry in a way that does not violate this law, but that means you're not allowed to do more than basic aggregates that can just as easily be collected on the backend. A collection of installed software can easily act as a globally unique identifier because every PC installation is different, so even training a "recommended for you" system that just finds other software that people commonly install along with a certain package must already be opt-in. Because of the requirement that combining data with other databases (server logs, for example) must not allow for unique identification of a single person in a data set, you really should only be using opt-in with informed consent. "We may use data as described in our privacy policy" is not informed consent, "we will send a list of all software you install, remove, change or update, when you do so and in what way you did it" comes close. Microsoft is severely lacking in this aspect. The developers add insult to injury by also lying about the theoretical ability to opt out.
- hendersoon 6y ago
  By "fine" I was making a personal judgment on ethics, not a legal one. You're correct in that it is illegal in the EU and probably in California USA.

4 ms·

It's fine to collect telemetry. It's even fine for it to be active by default, so users have to opt-out, although not my preference. That isn't what we're discu

by hendersoon 6y ago

jeroenhd 6y ago
Actually, any telemetry that, combined with other databases, can identify a single natural person located inside EU borders must be submitted with informed consent. This means that the average Joe must understand what information is being sent and the submission must be opt-out rather than opt-in. It's possible to do telemetry in a way that does not violate this law, but that means you're not allowed to do more than basic aggregates that can just as easily be collected on the backend. A collection of installed software can easily act as a globally unique identifier because every PC installation is different, so even training a "recommended for you" system that just finds other software that people commonly install along with a certain package must already be opt-in. Because of the requirement that combining data with other databases (server logs, for example) must not allow for unique identification of a single person in a data set, you really should only be using opt-in with informed consent. "We may use data as described in our privacy policy" is not informed consent, "we will send a list of all software you install, remove, change or update, when you do so and in what way you did it" comes close. Microsoft is severely lacking in this aspect. The developers add insult to injury by also lying about the theoretical ability to opt out.
- hendersoon 6y ago
  By "fine" I was making a personal judgment on ethics, not a legal one. You're correct in that it is illegal in the EU and probably in California USA.