> "they" who are receiving the data being collected about the user
I'm curious why you automatically assume data is being collected about the user? OpenTelemetry is about Observability, not user tracking.
I'm curious why you automatically assume data is being collected about the user? OpenTelemetry is about Observability, not user tracking.
In some ways, such information is just as important as biometrics and passwords and pii.
Deanonymizing becomes possible when metadata is cross-referenced. Metadata should be subject to as strict protection and consent rules as documents, health info, or any other "obvious" private data.
If it's running on your server and not logging third party activity or metadata, the information belongs to you. Else, you need the third party's consent, etc.
"It's just for benign development purposes" doesn't cut it anymore regardless of intentions. We need a cultural and legal area change with regards to privacy and primacy of private data protections.
I understand it seems extreme, but it's really not.
Any data generated by or on a user's device is private data. Recording that data is surveillance. No matter how harmless it might seem, data collection should be consensual, transparent, and ephemeral. You should specify, explain, and obtain consent for any and every variable. Anything you do with the data should be reportable to the user. Anything less creates opportunities for abuse.
Logging ip address connections is a great example. It's simple and trivial but how many RIAA piracy lawsuits do we have to see inflicted on innocents before we decide keeping those logs might not be a great idea?
The misuse of metadata by law enforcement through plausible narrative crafting is ubiquitous. It's not about the developer's intentions, it's about collection of surveillance records that can be seized or stolen and weaponized.