3 ms·

There should be laws against the collection of data without explicit opt-in consent. Oh wait, there already is, it’s just being completely ignored

Vinnl 4y ago
I don't know which law you're referring to specifically, but often they relate to personally identifiable information, and have carve-outs for non-PII data.
- hexo 4y ago
  IP address is personal info.
  - Vinnl 4y ago
    That's fair enough, and I believe just not storing it is not even enough. I'm not sure how they deal with that.
- Nextgrid 4y ago
  The GDPR for example, which enforces opt-in for anything not strictly necessary for the provision of the service (and no, telemetry doesn't count as "strictly necessary"), enforces the concept of data minimization (which means you must collect & process as little personal data as possible to fullfil your objective) and considers IP addresses as personal data.
  - timseverien 4y ago
    I reviewed the source-code before adding them to the site. I can’t say for sure IP addresses aren’t stored server-side, so we have to trust them that they don’t, but most tools do find creative ways to get some kind of unique and persistent IDs. For example, Astro computes a hash for the git repository remote URL, and Storybook computes an ID by hashing the first commit hash in the repo.
    - Nextgrid 4y ago
      The intent of the GDPR is to prevent the act of non-consensual tracking and not some specific technical method of achieving that, so even a deterministic ID generation method that doesn't rely on any client-side storage would still be in scope, as would a hypothetical crystal ball if it worked better than random chance at reidentifying a unique user.
  - Vinnl 4y ago
    > (and no, telemetry doesn't count as "strictly necessary") I'll start with the caveat that I'm not a lawyer, but I wouldn't be so sure. For example, knowing when your tool breaks for a user so you can fix it sounds like something that you could argue is necessary to make sure the tool works for the user.
    - Nextgrid 4y ago
      I think the standard for "strictly necessary" is whether that piece of data is necessary to provide the requested functionality. Does submitting an order form for some goods in any way depend on the telemetry requests you sent before/after? Would the order still go through if those requests were missing or fed fake data? If the answer to the above is true then "strictly necessary" would be difficult to apply. Of course the point is moot because so far GDPR enforcement is not only lacking to begin with but the cases that are investigated aren't given the right technical expertise to adequately determine those answers.

Vinnl 4y ago

I don't know which law you're referring to specifically, but often they relate to personally identifiable information, and have carve-outs for non-PII data.

hexo 4y ago
IP address is personal info.
- Vinnl 4y ago
  That's fair enough, and I believe just not storing it is not even enough. I'm not sure how they deal with that.
Nextgrid 4y ago
The GDPR for example, which enforces opt-in for anything not strictly necessary for the provision of the service (and no, telemetry doesn't count as "strictly necessary"), enforces the concept of data minimization (which means you must collect & process as little personal data as possible to fullfil your objective) and considers IP addresses as personal data.
- timseverien 4y ago
  I reviewed the source-code before adding them to the site. I can’t say for sure IP addresses aren’t stored server-side, so we have to trust them that they don’t, but most tools do find creative ways to get some kind of unique and persistent IDs. For example, Astro computes a hash for the git repository remote URL, and Storybook computes an ID by hashing the first commit hash in the repo.
  - Nextgrid 4y ago
    The intent of the GDPR is to prevent the act of non-consensual tracking and not some specific technical method of achieving that, so even a deterministic ID generation method that doesn't rely on any client-side storage would still be in scope, as would a hypothetical crystal ball if it worked better than random chance at reidentifying a unique user.
- Vinnl 4y ago
  > (and no, telemetry doesn't count as "strictly necessary") I'll start with the caveat that I'm not a lawyer, but I wouldn't be so sure. For example, knowing when your tool breaks for a user so you can fix it sounds like something that you could argue is necessary to make sure the tool works for the user.
  - Nextgrid 4y ago
    I think the standard for "strictly necessary" is whether that piece of data is necessary to provide the requested functionality. Does submitting an order form for some goods in any way depend on the telemetry requests you sent before/after? Would the order still go through if those requests were missing or fed fake data? If the answer to the above is true then "strictly necessary" would be difficult to apply. Of course the point is moot because so far GDPR enforcement is not only lacking to begin with but the cases that are investigated aren't given the right technical expertise to adequately determine those answers.