2

Homebrew is collecting anonymous GA analytics by default. User have this information during installation of this package manager. To opt-out you need go to the web page and choise a way to opt-out (set an envrionment variable or run a command).

Opting-out will prevent analytics to be sent. I don't know if analytics would be collected anyway and sent collected afterwards you opt-in collecting analytics again.

Is this behavior is GDPR-compliant or not?

  • 1
    Which behaviour? 1) the fact that you have to opt out at all? 2) the fact that maybe they are collecting that information, though storing locally in the machine, and if you ever opt in they may send the information collected in that period of time? Note that GDPR is about personal information. Depending on what they collect the data collected may not fall under GDPR at all. If they do keep track of PI then under GDPR you should be able to have a way to see which data they have on you. – Bakuriu Sep 6 '18 at 17:45
  • @Bakuriu Thank you for the answer, I was mislead by hype around – Eir Nym Sep 7 '18 at 6:20
1

This is probably GDPR compliant.

First, note that there may actually be no Personal Information collected, even the IP addresses are (supposedly) anonymised by Google and not stored. At least the developers have worked hard in trying so.

Homebrew is collecting anonymous GA analytics by default. User have this information during installation of this package manager. To opt-out you need go to the web page and choise a way to opt-out (set an envrionment variable or run a command).

Thus users are informed of the data collection and are able to easily opt-out. This may not be an explicit consent —depending on the way it appears on the install—, but it may not be needed.

Opting-out will prevent analytics to be sent. I don't know if analytics would be collected anyway and sent collected afterwards you opt-in collecting analytics again.

Looking at their implementation (analytics.rb, analytics.sh), there is not a separate collection step. When one of the events they record happens, it launches a query to Google Analytics (unless disabled by the environment, the configuration variable, or actually not having an internet connection). The event description is not saved anywhere that could be later sent.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.