Glavin001
commented
3 years ago Hi @idleberg , thank you for reaching out!
Atom-Beautify is currently using core.telemetryConsent as requested by GitHub team member almost 5 years ago in https://github.com/Glavin001/atom-beautify/issues/1179
I see your points on how this can be improved and would be happy to accept a Pull Request improving this area.
To help you or others write such a Pull Request, here are links to applicable code which would be useful:
- Package configuration: https://github.com/Glavin001/atom-beautify/blob/master/src/config.coffee
- Where config should be read from to enable/disable analytics: https://github.com/Glavin001/atom-beautify/blob/master/src/beautifiers/index.coffee#L267
- Old commit showing diff for reference: https://github.com/Glavin001/atom-beautify/commit/45a93451b638b08d9c234d75a269ce0033955609
Thanks for your interest and supporting this open source project!
Sloter88
This plugin is not GDPR-compliant and the same might be true for other privacy regulations, e.g. the CCPA. I will continue to use the GDPR as an umbrella term for similar regulations.
At the time of this writing, the authors assume that consent is given through the consent for GitHub's
metricpackage. This is problematic in many ways. Let's take a look at these simple definitions:I think these definitions are easy enough to understand for non-lawyers and it should be clear that all of these are violated. When accepted, each of these definitions is fulfilled between GitHub and the user. However, GitHub cannot be made liable for everyone else jumping the train – they don't know anything about what your code does, why would they vouch for it? Also, GitHub sends user data to its own servers, while this package sends it to a different party: Google Analytics.
Here's a simple example to illustrate the problem: A user installs Atom on January 1st, on the first startup he accepts the privacy policy between him/her and GitHub Inc. Nine months later, the user installs
atom-beautify. GitHub's policy is specific to the data collection of themetricspackage, the user is uninformed about the data collection ofatom-beautify— because GitHub's privacy policy is unambiguous that it applies to the collection by themetricspackage.It should be enough, if this package pops up a notification with "Accept" / "Reject" buttons and a link to your privacy policy. Or better, replicate the consent page used by the
metricspackage. However, since I'm not a lawyer, you might want to read about this online. There are plenty of free resources that provide guidance, including here on GitHub.