matt: matt: Well, there might be one thing we could do. CockroachDB–an insanely popular database startup–emits telemetry by default and they didn’t make a big fuss of it and nobody seems to mind; they have instructions on how to disable it but I doubt it would have this kind of response if they did open it up for community feedback. So I hope, given the alternatives, that people appreciate this instead of become all skeptical armchair experts.

I’ve always avoided projects like CockroachDB specifically for the reason that it emits telemetry by default.

Whenever I can I only use software that doesn’t track anything I’m doing, whether the data is anonymised or not. Being a developer this isn’t always possible since I have to use certain software throughout the day, but I do what I can.

Caddy is a little different in that it hasn’t emitted telemetry up to this point, and it’s the only server with sane default settings, so I don’t mind going through the hassle of disabling it entirely.

matt: matt: What do you mean by this? (And why do whatever that is instead of simply disabling it?)

Sorry, I was still being a bit too hyperbolic. I mean I’ll just compile it without telemetry (assuming that’s possible) and throw any flags onto the command line that would entirely disable it if required. It’s a real hassle, but Caddy has been so good in every other respect that I don’t mind having to do it, even if I think it should really be opt-in.

matt: matt: Yes, but I am not a lawyer and I cannot afford one. GDPR is EU law, and I have no presence in the EU. Additionally, GDPR applies specifically to personal information, which telemetry does not collect. Telemetry consists only of technical metrics. So I would say that GDPR does not apply.

Presence in the EU doesn’t matter, it will apply to anyone in any part of the world dealing with any data from anyone in the EU. So even if you’re based in the U.S., if you deal with any data from someone in the EU, then the GDPR applies to you. Like you say though, if you aren’t collecting personal data it probably doesn’t apply to you in this case.

I did have a quick look at the posts you linked to in the original post, and I tried to look for what kind of data you will be collecting. The post just says “aggregate counts”, which isn’t really useful at all, so I had a look at the diff on github, but there’s no way I’m going to look through the whole thing right now so I’ll just ask.

Do you collect IP addresses in any way, for any reason?

The reason I ask is because in some cases GDPR does consider an IP address to be personal information, so if you collect them in any way then you might want to look into it a bit more.

To be honest, even if you don’t think you’re collecting any personal data, and even if you don’t think it applies to you, you should look into the GDPR anyway, since it will apply to you if you end up collecting something that seems benign, but turns out to be considered “personal” by the regulation.

matt: matt: I expect people to follow the laws of the land in which they live.

The reason I asked if you thought about how it might affect users of Caddy is because opt-out by default could make following the law in certain countries more of a hassle.

There will of course also be people that don’t realise that Caddy is emitting telemetry and may be violating laws in their own country without realising.

You can always say that the onus is on the user to check their software before they use it, and I would agree, but I thought Caddy was trying to make things easy, right?

It could be that Caddy emitting telemetry wouldn’t put anyone in violation of any laws around the world, but since I don’t know the laws of every country in the world I would personally err on the side of caution and say that opt-in is just the better choice when thinking about the best interests of the user.

matt: matt: You should ask a lawyer that if you’re that concerned.

I’m not concerned for myself. I believe opt-in is the right choice, but like I said I’ll be disabling the whole thing anyway since I know what I’m doing.

Either way, from your responses so far it seems like you have your heart set on making it opt-out by default, so I doubt you’ll change your mind; this is your project after all.

Having said that, I’m sure that most people would appreciate it being opt-in by default, even just for their own peace of mind, which is a perfectly valid reason that someone might want it to be that way, and should be considered as a serious argument against opt-out by default.

The reason I say this is because really, your only real argument for opt-out by default is to not introduce bias in the data that’s been gathered, which is just as arbitrary and based on personal motivation and emotion as any argument out there for opt-in since there isn’t any technical reason for it.

I wish I could give you some concrete technical arguments for opt-in, but it seems like when it comes to this issue it’s almost entirely based on motivation and emotion, so technical arguments won’t do for either side.