``` // Start speech recognition using the browser's speech recognition API function CN_StartSpeechRecognition() { ```
As far as I know, speech recognition in Chrome, unlike on Android phones, is being done online. Means audio is being sent to Google servers. How does this comply with GDPR?
I'm no expert, but I would imagine this is Google's problem. The website is calling an API that no reasonable person would expect to leak data to Google – in fact, Google has an implementation that doesn't – yet personal data is being leaked, without the user's consent.
At no point does the operator of this website act as controller for the voice data.
But could there be a more on the nose example of why the EU lags in tech innovation and entrepreneurship? An solo maker builds a cool little tool as a personal project, open sources it on github, and is immediately attacked for the effort by cosplay compliance regulators. It defies parody.
The commenters also have a cartoon understanding of the GDPR - the author of the Chrome extension is neither a data controller nor a data processor.
I'd ask the commenters that jump on a project like this to introspect a bit and try to understand why their first impulse on seeing someone's effort like this is to try to take it down.
It seems to be an eternal cyclical process: people come up with something that either sidesteps or has no regulation whatsoever, you get massive growth and innovation, which turns to exploitation, which leads to regulation.
We've seen it in all fields, from tech to pharmaceuticals to big box retail. Is it an acceptable compromise in society to "let things happen" for a while before regulating? Or should we all slow down and think about the consequences before pushing forward?
I don't see GDPR as preventing innovation. Quite on the contrary, it has enabled European companies, which host their data by default in the EU, to create competitive products.
That being said, I think in Europe there's, compared to the US, more old money controlled by people who don't like to share or lose their wealth.
And what if the source someone shares is using APIs that aren't GDPR complaint? That you can download, compile it, run it on your machine and then say that it was offered to you and so must be GDPR compliant.
I'm not in the EU and not familiar with the particulars of GDPR but that feels like it is stretching for a reason to complain.
Does this even count as something that would be covered by GDPR? Is it because the data collection is tangential to the "service" being offered?
Chrome's Privacy page [1] doesn't say anything about the API. Other people have also been wondering about the privacy implications of using the Speech API. What an interesting rabbit hole!