4 ms·

I'd accept making it opt-in, but opt-out is ridiculous. I can't imagine how they're going to get this past EU regulators. I love (although loved more in the pa

I'd accept making it opt-in, but opt-out is ridiculous. I can't imagine how they're going to get this past EU regulators. I love (although loved more in the past) 1Password and have deployed it in two separate companies. Between this and recent UI updates (well, over the last couple of years), maybe it's time to look at alternatives.

Negitivefrags 4y ago
If you don’t collect any identifiable data, then the EU has nothing to say about it.
- closewith 4y ago
  Unless they have a non-IP based communication system, then they'll fall afoul of the same thing all online analytics services do - they'll be collecting, at least ephemerally, personal data under the EU definition.
  - Negitivefrags 4y ago
    It is my understanding that if you do not log the IPs that connect, then you are not collecting personal data.
    - closewith 4y ago
      Last year, a German court fined a website for using Google Fonts as it was providing the IP address to Google without authorization and without a legitimate reason for doing so. It seems likely that the same reasoning will apply here.
abigail95 4y ago
What about anonymous logging of which buttons people click on is illegal in the EU? Citation needed on this one. That would make any dashboard that showed which api endpoints are the most popular also illegal. Anomyous telemetry is not PII. GDPR is personal data.
- nness 4y ago
  As long as there's no "session identifier," even if unique and completely unmarriable to the PII, it doesn't matter. Any session ID where an ID represents one person runs afoul. Makes meaningful telemetry really hard without consent. Everyone just consents anyway...
  - abigail95 4y ago
    My position is they can indeed get meaningful telemetry with opt-out anonymised data and that the GDPR does not prevent this. I am countering the position of the parent poster and asking for a citation that would indicate you don't need to sneak this around the EU regulators to do it.
  - alpaca128 4y ago
    > Everyone just consents anyway... Unless you don't lie to them and don't use every dark pattern in the book to trick them into clicking the checkbox.
- JohnFen 4y ago
  > Anomyous telemetry is not PII. That depends. First, no data collection is "anonymous" when it is transmitted. Any anonymity must come later, and then is only possible if the company aggregates the data with other users and deletes the original data that was collected. PII/Personal Data are squishy terms. In the US, anyway, the legal definitions of what counts as "PII" leaves out an awful lot of actual PII -- so any claims that "no PII is being collected" is meaningless without additional explanation of what data items are being collected.
  - abigail95 4y ago
    We are talking EU and I specifically asked for Citation needed, and I realize you aren't the poster but this doesn't really answer my question. Are we assuming 1Password is lying about anonymisation? My point is they didn't "sneak it past the regulators", it's plainly legal to do this under GDPR, and if it isn't I need a citation.
bwoodruff 4y ago
I wrote more about the consent aspect here: https://news.ycombinator.com/item?id=35706897 https://news.ycombinator.com/item?id=35706897 tl;dr If we roll this out to customers, we'll be asking for consent, and won't be collecting telemetry data unless we have it. -Ben, 1Password
- closewith 4y ago
  That's much more reasonable than the wording on the linked page. Thanks for your response.
  - bwoodruff 4y ago
    Happy to help. In addition, while we're in the early stages and this design is likely to change, it may help to visualize how we're thinking about this process: https://bucket.agilebits.com/ben/telemetry-consent-draft.png https://bucket.agilebits.com/ben/telemetry-consent-draft.png

Negitivefrags 4y ago

If you don’t collect any identifiable data, then the EU has nothing to say about it.

closewith 4y ago
Unless they have a non-IP based communication system, then they'll fall afoul of the same thing all online analytics services do - they'll be collecting, at least ephemerally, personal data under the EU definition.
- Negitivefrags 4y ago
  It is my understanding that if you do not log the IPs that connect, then you are not collecting personal data.
  - closewith 4y ago
    Last year, a German court fined a website for using Google Fonts as it was providing the IP address to Google without authorization and without a legitimate reason for doing so. It seems likely that the same reasoning will apply here.

abigail95 4y ago

What about anonymous logging of which buttons people click on is illegal in the EU? Citation needed on this one. That would make any dashboard that showed which api endpoints are the most popular also illegal. Anomyous telemetry is not PII. GDPR is personal data.

nness 4y ago
As long as there's no "session identifier," even if unique and completely unmarriable to the PII, it doesn't matter. Any session ID where an ID represents one person runs afoul. Makes meaningful telemetry really hard without consent. Everyone just consents anyway...
- abigail95 4y ago
  My position is they can indeed get meaningful telemetry with opt-out anonymised data and that the GDPR does not prevent this. I am countering the position of the parent poster and asking for a citation that would indicate you don't need to sneak this around the EU regulators to do it.
- alpaca128 4y ago
  > Everyone just consents anyway... Unless you don't lie to them and don't use every dark pattern in the book to trick them into clicking the checkbox.
JohnFen 4y ago
> Anomyous telemetry is not PII. That depends. First, no data collection is "anonymous" when it is transmitted. Any anonymity must come later, and then is only possible if the company aggregates the data with other users and deletes the original data that was collected. PII/Personal Data are squishy terms. In the US, anyway, the legal definitions of what counts as "PII" leaves out an awful lot of actual PII -- so any claims that "no PII is being collected" is meaningless without additional explanation of what data items are being collected.
- abigail95 4y ago
  We are talking EU and I specifically asked for Citation needed, and I realize you aren't the poster but this doesn't really answer my question. Are we assuming 1Password is lying about anonymisation? My point is they didn't "sneak it past the regulators", it's plainly legal to do this under GDPR, and if it isn't I need a citation.

bwoodruff 4y ago

I wrote more about the consent aspect here: https://news.ycombinator.com/item?id=35706897 https://news.ycombinator.com/item?id=35706897 tl;dr If we roll this out to customers, we'll be asking for consent, and won't be collecting telemetry data unless we have it. -Ben, 1Password

closewith 4y ago
That's much more reasonable than the wording on the linked page. Thanks for your response.
- bwoodruff 4y ago
  Happy to help. In addition, while we're in the early stages and this design is likely to change, it may help to visualize how we're thinking about this process: https://bucket.agilebits.com/ben/telemetry-consent-draft.png https://bucket.agilebits.com/ben/telemetry-consent-draft.png