4 ms·

What is the argument for opt-out telemetry being unethical?

• _ph_ 4y ago
  Because it most likely means that people are sending data without their consent. Perhaps I am naive or just very old, but I wouldn't expect a compiler to "phone home" with information about what I do with it. Certainly not without me expressing consent first. So if you want that information, find a way to ask the user first. If you can give a good and understandable explanation on how the information is useful, the users might give their consent happily.
• delusional 4y ago
  I don't think it's all telemetry. I suppose telemetry could be designed in a way that preserves the users privacy to an extent that is compatible with their native assumption. I suppose that design also depends on what you're building. If you're building a website, I think it's fairly reasonable for you to store my IP. That's inside my expected privacy loss when dealing with a remote party. I have to connect to your computer, much like i have to physically walk into a store. I don't mind you remembering that I was there. Running a compiler on the other hand feels more "private" to me somehow. My expectation when using a compiler is that it won't send anything to anyone, because why would it? In general I think our industry is starved for relevant and foundational ethics research, outside of the FSF at least.
• masklinn 4y ago
  Because that goes against informed consent. Opt-out is generally rejected by European privacy laws.
  • remus 4y ago
    > Opt-out is generally rejected by European privacy laws. ...where personal data is involved. It strikes me that this proposal goes to considerable lengths to avoid collecting anything that could be considered personal data.
    • IanCal 4y ago
      I agree it does do that though for context of others reading the thread personal data is a very broad topic: https://gdpr.eu/eu-gdpr-personal-data/ https://gdpr.eu/eu-gdpr-personal-data/ You have to be very careful to do it properly.
    • balena 4y ago
      IANAL but European law is nuanced over whether IP addresses are PII. If I'm not mistaken it's been ruled they are for ISPs, rationale being they have enough other data points that once correlated with IP addresses allow to identify individuals. Whether the same applies to Google (I suppose) is definitely not clear to me.
      • Scaevolus 4y ago
        The proposal explicitly says they don't collect IP addresses or _any_ unique identifiers.
        • gwillen 4y ago
          As far as I'm aware/recall, European privacy laws consider any connection back to a telemetry server to count as "collecting" IP addresses, since the telemetry server learns it (even if they pinky swear not to write it down.)
          • notpushkin 4y ago
            Can you send telemetry data through Tor, though? :thinking:
          • rcme 4y ago
            I think privacy laws only apply to things that “process” PII. Accepting a network connection is not, in and of itself, considered to process PII.
          • ohgodplsno 4y ago
            You don't recall perfectly well. Storing IP addresses in logs means that you are now responsible for them, yes. Drop them out of your logs, and you're perfectly fine.