Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft: Require user consent before sending any telemetry

github.com

Post reply on HN
Print view View original

21–30 of 129 posts

Re: Microsoft: Require user consent before sending any telemetry

#21

Post by kvdveer »

fhub wrote: post #6

Truly anonymous data is not subject to the GDPR. So the question is whether the data they are collecting is truly anonymous. They seem to be claiming or suggesting "Yes it is" https://code.visualstudio.com/docs/getstarted/telemetry#_gdp... .

It is neigh impossible to send truly anonymous data as telemetry. As soon as you're using the internet, you're disclosing an IP address, which is PII. If you add anything to link two subsequent telemetry reports together, that thing is PII (e.g. a hash or a uuid). If the telemetry report is detailed enough that they become somewhat unique, it's PII.

That said, consent is not the only grounds on which you can process PII. Contract, legal obligation, vital interests, public task, or legitimate interests are also valid grounds. Of these, legitimate interests is the most applicable in this situation.

Re: Microsoft: Require user consent before sending any telemetry

#22

Post by JCWasmx86 »

cowl wrote: post #20
fhub wrote: post #6

Truly anonymous data is not subject to the GDPR. So the question is whether the data they are collecting is truly anonymous. They seem to be claiming or suggesting "Yes it is" https://code.visualstudio.com/docs/getstarted/telemetry#_gdp... .

There is no such thing as truly anonymous. in order to send any data you need to connect to a server. at that moment you are in violatation of GDPR because you are exposing the users's IP which is protected by GDPR. See the case where even linking to a CDN requires GDPR consent. https://www.cpomagazine.com/data-protection/leak-of-ip-addre... And before the army of those who don't understand GDPR comes up with "but th…

Wouldn't even be checking Microsoft's server be an unnecessary connection? You could argue, that VSCode would still work, as updates are basically optional and could be triggered manually, too

Re: Microsoft: Require user consent before sending any telemetry

#23

Post by Sakos »

osigurdson wrote: post #15

A user should be able to configure a program (or all programs) such that outgoing communication is not possible, logged or both. It really shouldn't be up to the program to decide what it wants to send as it could easily scan the entire hard drive on the users behalf.

Have you tried running a firewall with explicit prompts? Everything connects home now. It's infuriating.

Re: Microsoft: Require user consent before sending any telemetry

#24

Post by IshKebab »

kvdveer wrote: post #21
fhub wrote: post #6

Truly anonymous data is not subject to the GDPR. So the question is whether the data they are collecting is truly anonymous. They seem to be claiming or suggesting "Yes it is" https://code.visualstudio.com/docs/getstarted/telemetry#_gdp... .

It is neigh impossible to send truly anonymous data as telemetry. As soon as you're using the internet, you're disclosing an IP address, which is PII. If you add anything to link two subsequent telemetry reports together, that thing is PII (e.g. a hash or a uuid). If the telemetry report is detailed enough that they become somewhat unique, it's PII. That said, consent is not the only grounds on which you can process…

> It is neigh impossible

Haha sorry I couldn't continue past that! Neeeiiigggh!

Re: Microsoft: Require user consent before sending any telemetry

#25

Post by sirius87 »

kvdveer wrote: post #21
fhub wrote: post #6

Truly anonymous data is not subject to the GDPR. So the question is whether the data they are collecting is truly anonymous. They seem to be claiming or suggesting "Yes it is" https://code.visualstudio.com/docs/getstarted/telemetry#_gdp... .

It is neigh impossible to send truly anonymous data as telemetry. As soon as you're using the internet, you're disclosing an IP address, which is PII. If you add anything to link two subsequent telemetry reports together, that thing is PII (e.g. a hash or a uuid). If the telemetry report is detailed enough that they become somewhat unique, it's PII. That said, consent is not the only grounds on which you can process…

"Disclosing an IP address" maybe a matter of the medium of comms being inadvertently TCP/IP, if MS does not log or store the IP in a meaningful/reversible way, are they processing PII?

Re: Microsoft: Require user consent before sending any telemetry

#26

Post by blackoil »

lnxg33k1 wrote: post #9
bogantech wrote: post #4

To be fair if someone comments to me with things like: > Please give an answer within the next week until the 16th of June. I wouldn't respond to them either out of spite

The issue with society or one of them, is thinking its acceptable for a corporation breaking law to feel spite, the guy was not talking to a person, was talking to a shitty corp breaking law

Which law? Instead of shit talking, they can report it, file lawsuit.

Re: Microsoft: Require user consent before sending any telemetry

#27

Post by smarx007 »

blackoil wrote: post #26
lnxg33k1 wrote: post #9

Earlier quoted context omitted.

The issue with society or one of them, is thinking its acceptable for a corporation breaking law to feel spite, the guy was not talking to a person, was talking to a shitty corp breaking law

Which law? Instead of shit talking, they can report it, file lawsuit.

G.D.P.R., it says so in the thread.

And Europe is not a litigious environment, we start with complaints first.

Re: Microsoft: Require user consent before sending any telemetry

#28

Post by cowl »

JCWasmx86 wrote: post #22
cowl wrote: post #20

Earlier quoted context omitted.

There is no such thing as truly anonymous. in order to send any data you need to connect to a server. at that moment you are in violatation of GDPR because you are exposing the users's IP which is protected by GDPR. See the case where even linking to a CDN requires GDPR consent. https://www.cpomagazine.com/data-protection/leak-of-ip-addre... And before the army of those who don't understand GDPR comes up with "but th…

Wouldn't even be checking Microsoft's server be an unnecessary connection? You could argue, that VSCode would still work, as updates are basically optional and could be triggered manually, too

Yes, I meant connecting to update/install in response to a user action that wants to install extension for "X functionality".

Re: Microsoft: Require user consent before sending any telemetry

#30

Post by mappu »

kvdveer wrote: post #21
fhub wrote: post #6

Truly anonymous data is not subject to the GDPR. So the question is whether the data they are collecting is truly anonymous. They seem to be claiming or suggesting "Yes it is" https://code.visualstudio.com/docs/getstarted/telemetry#_gdp... .

It is neigh impossible to send truly anonymous data as telemetry. As soon as you're using the internet, you're disclosing an IP address, which is PII. If you add anything to link two subsequent telemetry reports together, that thing is PII (e.g. a hash or a uuid). If the telemetry report is detailed enough that they become somewhat unique, it's PII. That said, consent is not the only grounds on which you can process…

With that argument - would it hypothetically be legal for anonymised telemetry to be submitted over Tor?
Post reply on HN