Hacker News Reader

Comment by eksemplar | Hacker News Reader

If the data is completely anonymous it’s not really breaking the GDPR. If it’s not voluntary they are in a range of other problems though.

View on HN

> If the data is completely anonymous it’s not really breaking the GDPR. If it’s not voluntary they are in a range of other problems though.

The telemetry can't be completely anonymous. It's attached to an IP address and the EU considers that PII: https://www.enterprisetimes.co.uk/2016/10/20/ecj-rules-ip-ad....

If they don't store the IP address it might be OK.

I believe it is a common practice to remove the last part of the IP to make it sufficiently anonymous.

Disclaimer: I used to work for Microsoft, and this is what we did.

Zeroing out the lest-interesting octet of an IPv4 address is only a placebo that doesn't provide any useful anonymity. The other data being collected at the same time almost certainly has enough identifying entropy to correlate a partial IPv4 address with other personally identifying records, probably trivially.

For a longer explanation, see my post about the &aip=1 feature in Google Analytics that does the same thing to the end of the IP.

https://news.ycombinator.com/item?id=17170468

This is fair, I can only say that we (in my team at least) have gone great lengths to anonymize data as much as possible. No internal user IDs, no user entered text, it got to a point that we were becoming ineffective in diagnostics of outages...

Unless there is no opt out.. Unless the data is for core functionality, a lawful purpose you have to have consent. I would consult a lawyer on this if you have any doubts. I suspect Microsoft have done already though.

Reply on news.ycombinator.com