5 ms·

Well, in Europe, if you want to know how much a user pays, you need to tie telemetry to their account containing personal information, which is forbidden by GPR

Well, in Europe, if you want to know how much a user pays, you need to tie telemetry to their account containing personal information, which is forbidden by GPRD unless they give their explicit consent and they have a process to delete/rectify/download all of it. Since most telemetry are optout and don't bother about giving users access to their data, they can't legally do it. That's my point really: useful telemetry is really, really invasive. So just ask consent, and accept most users will tell you no. If you chose what's convenient instead, you will not only have a mixed bag of data, but also you have decide to basically force yourself on people, in an age where a part of your userbase is getting upset over things like using the wrong pronoun on them. I tell yes to Firefox and VLC to report on my usage. It tell no to Google and Microsoft. They want their cake and it it: behave badly, and then have we trust them.

cutemonster 4y ago
> give their explicit consent They already need to agree to Terms of Service when paying and starting to use the software.
- 3836293648 4y ago
  And that is not explicit consent. Explicit consent needs to be standalone and refusing it cannot stop the user from doing anything that doesn't actually really require said consent.
  - JohnFen 4y ago
    Right. A mention in the ToS does not equal real consent. I would only add that it also has to be informed consent. Saying something like "can we collect data from you to improve our products and services?" is also not soliciting real consent, because it tells the user basically nothing about what is being asked of them and how it will be used.
    - cutemonster 4y ago
      You think that keeping track of "This paying user uses this and that feature, and is thus on the correct price plan" is a violation of the GDPR, assuming it's mentioned in the privacy police and maybe ToS?
      - JohnFen 4y ago
        I don't know what does or does not violate the GDPR, and I'm not talking about metering services. I'm talking about telemetry for installed software. I'm not even talking about what the law says, because the law is very inadequate on these matters (in the US, anyway). I'm talking about, from a common-sense point of view, what "consent" is. In my view, it can only be counted as "consent" if I have been informed exactly what it is that I'm consenting to, and I am asked for that consent. ToS don't count for a number of reasons, starting with the fact that nobody reads them, it's unrealistic to expect people to read them (because everything comes with lengthy ToS documents and if you really read them all, little time would be left to do anything else), they are generally difficult to properly understand if you're not a lawyer, and they are are usually intentionally vague of this issue -- which means the "informed" part of "informed consent" isn't satisfied even if you do read them. I think the Principle of Least Surprise should apply here. If software is going to do something that users won't notice happening, is intrusive, and isn't pretty obvious from the nature of the software, the right thing to do is to tell the user about it and ask for permission. Software that doesn't do this is adversarial to the user.
        cutemonster 4y ago
        That seems interesting, when thinking about pro rated subscription fees -- if a feature isn't being used, it'd cost nothing. But with telemetry disabled by default, the company couldn't detect that the feature wasn't being used, and thus the customer would pay more. And if opting in to telemetry, the customer pays less and the company gets telemetry.

cutemonster 4y ago

> give their explicit consent They already need to agree to Terms of Service when paying and starting to use the software.

3836293648 4y ago
And that is not explicit consent. Explicit consent needs to be standalone and refusing it cannot stop the user from doing anything that doesn't actually really require said consent.
- JohnFen 4y ago
  Right. A mention in the ToS does not equal real consent. I would only add that it also has to be informed consent. Saying something like "can we collect data from you to improve our products and services?" is also not soliciting real consent, because it tells the user basically nothing about what is being asked of them and how it will be used.
  - cutemonster 4y ago
    You think that keeping track of "This paying user uses this and that feature, and is thus on the correct price plan" is a violation of the GDPR, assuming it's mentioned in the privacy police and maybe ToS?
    - JohnFen 4y ago
      I don't know what does or does not violate the GDPR, and I'm not talking about metering services. I'm talking about telemetry for installed software. I'm not even talking about what the law says, because the law is very inadequate on these matters (in the US, anyway). I'm talking about, from a common-sense point of view, what "consent" is. In my view, it can only be counted as "consent" if I have been informed exactly what it is that I'm consenting to, and I am asked for that consent. ToS don't count for a number of reasons, starting with the fact that nobody reads them, it's unrealistic to expect people to read them (because everything comes with lengthy ToS documents and if you really read them all, little time would be left to do anything else), they are generally difficult to properly understand if you're not a lawyer, and they are are usually intentionally vague of this issue -- which means the "informed" part of "informed consent" isn't satisfied even if you do read them. I think the Principle of Least Surprise should apply here. If software is going to do something that users won't notice happening, is intrusive, and isn't pretty obvious from the nature of the software, the right thing to do is to tell the user about it and ask for permission. Software that doesn't do this is adversarial to the user.
      - cutemonster 4y ago
        That seems interesting, when thinking about pro rated subscription fees -- if a feature isn't being used, it'd cost nothing. But with telemetry disabled by default, the company couldn't detect that the feature wasn't being used, and thus the customer would pay more. And if opting in to telemetry, the customer pays less and the company gets telemetry.