What about server logs? If I send an http request to a server, do I have any right to say they can't log that request? What about the database metrics?
Data about me, my machines, or my use of my machines is private data. Nobody has any right to it besides me. If it's being collected without my informed consent, that's just spying.
It's very difficult to tell what data is really being reported by an application. The majority of the time, all we have to go by is what the developer says is being collected.
But the developer claims cannot be considered trustworthy by default. Many developers have simply lied in the past about what they collect. And even if the developer is truthful, they can only speak for what the software is doing at the moment. There's no guarantee that the developer won't change their mind in the future, or the product won't be sold to another company that isn't so considerate of their users.
Also though, interestingly Walmart actually really does do the equivalent of this: https://bernardmarr.com/walmart-big-data-analytics-at-the-wo.... They have real-time detailed metrics for individual customer transaction behaviour in stores, and I would not be surprised at all if they tracked lots more, e.g. the total number of cars in parking lots, how long different cohorts of customers spend in stores, etc.
And the problem is even bigger, how do i know what data is being collected? even if it declared publicly somewhere, do i need to check on each update if the collected data has changed?
> otherwise they'd be begging for a GDPR problem
They have in fact a GDPR problem but like in the case above where it was not Google to answer for the GDPR Problem but the site that used Google CDN, in this case too, most probably it will not be these toolmakers who are taken to court but the companies that asking their employees to use these tools without disclosing this personal IP leak. If this becomes the norm how much burdon do we have to go through to verify each tool whether we need to ammend the employee GDPR consents or not? I see this already having an effect... Just standardise only on Microsoft tools so at least we need to gather GDPR consent only for Exposing data to Microsoft...
Personally, I like to implement a “Report a bug” button which sends detailed telemetry when it really matters. To keep an eye on more general usage data, I use Cloudflare Web Analytics. It’s easy to build a toggle for analytics. Personally, I find that more than sufficient, especially when combined with traditional user studies.
Having the backend respect the toggle too wouldn’t be that hard.
Yes, absolutely.
That website's code is being executing on my machine, consuming my power, then using my internet service to phone home with a data package of arbitrary size.