3

I'm planning to sell my software online. The payment process is handled by a reseller (FastSpring), so the personal data collected (like the buyer's name and e-Mail address) is never stored on my servers.

I supply a license that allows the user to use the software on up to three devices. To enforce this, I store a unique device identifier in my database whenever a license is used to activate the product.

Does this unique device identifier count as personal data under the GDPR, i.e. do I need to add GDPR disclaimers to my privacy policy and take the required steps, such as appointing a "Data Protection Officer" in my company, or can I safely go without it?

I'd argue that the unique device identifier does not allow me to trace the license to any specific individual, only to a device.

Would it help if I encrypted the device identifier in my database?

Improve this question
2
  • How do you know you sold a license? If you use a license ID, that ID will also be personal data (unless you sold the license to a company). And what data do you share with your reseller? Probably you also share personal data. And are you sure your reseller is a data controller and not a data processor?
    – wimh
    Commented Jan 18, 2020 at 11:57
  • The reseller calls a webhook on my backend server as soon as they've verified a purchase, which generates the license and stores it in the database, allowing it to be used to activate the software. I don't know who that license is generated for, only that someone successfully bought the product.
    – CrushedPixel
    Commented Jan 18, 2020 at 12:26

1 Answer 1

Reset to default
3

It depends on the device identifier.

For example, if you distribute your application through Apple's App Store, there is no way for you to get any identifier for the device. You can get an identifier that is unique for the combination of the device + your application, so you can verify that the same user doesn't use the application on four devices. But if I have another application, we can't combine our data to see who has purchased both applications, because we get different device identifiers for the same device. So that device identifier is totally meaningless to anyone other than you.

(Years ago Apple supplied real device identifiers. They stopped for privacy reasons, and because some developers were just stupid - they didn't consider that I could sell my phone to you and buy a new one. So if I sold you my phone, you reset it completely and purchased a certain game, you would get my high scores because your phone has same device identifier that I used for ages).

Improve this answer
3
  • Does this answer refer to the gethostuuid system call on macOS? That's the one I use as the device identifier. I don't distribute my application through the App Store, though - I supply an installer on my website, I'm not sure if that makes a difference!
    – CrushedPixel
    Commented Jan 18, 2020 at 15:17
  • 2
    gethostuuid has been deprecated in iOS 5.0 (in other words, in prehistoric times) and iOS applications using it cannot be put on the app store. On MacOS, I can't easily find a feature equivalent to iOS per-app device identifier, so I would assume you have personal data here.
    – gnasher729
    Commented Jan 18, 2020 at 15:56
  • Thanks for your insight! I'll probably take all the steps to be GDPR compliant, even though it may or may not be required in this case. Better safe than sorry :)
    – CrushedPixel
    Commented Jan 19, 2020 at 0:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .