4 ms·

Cloudflare needs the data. Useful to validate the impact of changes, build marketing content... Using the free tier for this is fair, they let you opt out, they

Cloudflare needs the data. Useful to validate the impact of changes, build marketing content... Using the free tier for this is fair, they let you opt out, they give you a dashboard. If someone is mad, maybe they should pay or use a different architecture.

Kevcmk 1mo ago
Shill
- cryptonym 1mo ago
  I'm not a Cloudflare customer and don't intend to actually use their services. To be transparent I got a free account for few experiments. I'm not working for them in any way. When it's free you know you are being used, collecting data is the game.
whilenot-dev 1mo ago
> this is fair, they let you opt out, they give you a dashboard So they give you something else you didn't ask for and therefor it's "fair"? I think it's pretty dubious to extend services with such data collecting features without informing affected users first, and making it clear how to opt-out before its deployment. A blog post won't do, no.
- cryptonym 1mo ago
  You are not paying and it's a business. They need to get something from this deal and they'll maximize it: marketing, data, upselling... Collecting RUM and giving you the opportunity to turn it off is not that bad for a free service. Makes me wonder if their stuff is GDPR-compliant without consent. If not, then ok, maybe that's bad to turn it on by default.
  - whilenot-dev 1mo ago
    Even on free tiers there are Terms of Use you'll need to agree to as a user of their services. Like I said, it's dubious to alter a service and collect data without informing the user first, free tier or not. There's a reason I got emails from LinkedIn regarding its new AI training purposes, and they made it clear how to opt-out and provided a deadline. I'm on a free tier there as well. So I'd question the legality of this even before any discussions about GDPR enter the picture.
    - cryptonym 1mo ago
      They are not collecting and using your personal data. To me (IANAL), it looks really different from LinkedIn. GDPR is about legality and covers the LinkedIn case you mention.
      - whilenot-dev 1mo ago
        > They are not collecting and using your personal data. Do you see how GDPR doesn't apply, then? ...you're contradicting yourself. I'd still question the legality of the data collection by altering the offered service without properly informing the affected users. Whether GDPR applies doesn't matter, and whether it's a free tier service doesn't matter either. You're a consumer of Cloudflare, so any consumer rights apply.
        cryptonym 1mo ago
        GDPR very much applies. As a website owner, you are responsible towards your users for data collection (your architectural choices, your responsibility). This was my concern on GDPR. Sibling comment says data collection is disabled in EU.
        whilenot-dev 1mo ago
        Cool, so you went from > Cloudflare needs the data. [...] If someone is mad, maybe they should pay or use a different architecture. To "they would violate GDPR". Are you ok with that behavior then? And are you basing your ethical decision solely on the current legislation?
  - hinata08 1mo ago
    > Makes me wonder if their stuff is GDPR-compliant without consent. GDPR service providers and partners do not have to consent. Consent is for the users. Services providers have to tell you when they collect your data, and they will most likely fail to do that if they don't even know their partner injects code. *So you're liable if you host on cloudflare.* Now, they somehow avoid this : >when enabling Web Analytics, you can choose to drop requests from European and UK visitors if you so desire (listed here specifically), meaning we will not collect any RUM metrics from traffic that passes through our European and UK data centers. The version of Web Analytics that will be enabled by default excludes data from EU visitors (this can be changed in the dashboard if you want). By default, it is only enabled for visitors from out of the EU, like so many services that respect your privacy and your concerns are their first priority
jnovek 1mo ago
I don’t think anyone in these comments expects to get something for nothing, it’s that MITMing your payload is something that feels like a betrayal of trust unless you are crystal clear that you’re doing it. Considering how many people in these comments are surprised by this, it seems like Cloudflare hasn’t been crystal clear.

Kevcmk 1mo ago

Shill

cryptonym 1mo ago
I'm not a Cloudflare customer and don't intend to actually use their services. To be transparent I got a free account for few experiments. I'm not working for them in any way. When it's free you know you are being used, collecting data is the game.

whilenot-dev 1mo ago

> this is fair, they let you opt out, they give you a dashboard So they give you something else you didn't ask for and therefor it's "fair"? I think it's pretty dubious to extend services with such data collecting features without informing affected users first, and making it clear how to opt-out before its deployment. A blog post won't do, no.

cryptonym 1mo ago
You are not paying and it's a business. They need to get something from this deal and they'll maximize it: marketing, data, upselling... Collecting RUM and giving you the opportunity to turn it off is not that bad for a free service. Makes me wonder if their stuff is GDPR-compliant without consent. If not, then ok, maybe that's bad to turn it on by default.
- whilenot-dev 1mo ago
  Even on free tiers there are Terms of Use you'll need to agree to as a user of their services. Like I said, it's dubious to alter a service and collect data without informing the user first, free tier or not. There's a reason I got emails from LinkedIn regarding its new AI training purposes, and they made it clear how to opt-out and provided a deadline. I'm on a free tier there as well. So I'd question the legality of this even before any discussions about GDPR enter the picture.
  - cryptonym 1mo ago
    They are not collecting and using your personal data. To me (IANAL), it looks really different from LinkedIn. GDPR is about legality and covers the LinkedIn case you mention.
    - whilenot-dev 1mo ago
      > They are not collecting and using your personal data. Do you see how GDPR doesn't apply, then? ...you're contradicting yourself. I'd still question the legality of the data collection by altering the offered service without properly informing the affected users. Whether GDPR applies doesn't matter, and whether it's a free tier service doesn't matter either. You're a consumer of Cloudflare, so any consumer rights apply.
      - cryptonym 1mo ago
        GDPR very much applies. As a website owner, you are responsible towards your users for data collection (your architectural choices, your responsibility). This was my concern on GDPR. Sibling comment says data collection is disabled in EU.
        whilenot-dev 1mo ago
        Cool, so you went from > Cloudflare needs the data. [...] If someone is mad, maybe they should pay or use a different architecture. To "they would violate GDPR". Are you ok with that behavior then? And are you basing your ethical decision solely on the current legislation?
- hinata08 1mo ago
  > Makes me wonder if their stuff is GDPR-compliant without consent. GDPR service providers and partners do not have to consent. Consent is for the users. Services providers have to tell you when they collect your data, and they will most likely fail to do that if they don't even know their partner injects code. *So you're liable if you host on cloudflare.* Now, they somehow avoid this : >when enabling Web Analytics, you can choose to drop requests from European and UK visitors if you so desire (listed here specifically), meaning we will not collect any RUM metrics from traffic that passes through our European and UK data centers. The version of Web Analytics that will be enabled by default excludes data from EU visitors (this can be changed in the dashboard if you want). By default, it is only enabled for visitors from out of the EU, like so many services that respect your privacy and your concerns are their first priority

jnovek 1mo ago

I don’t think anyone in these comments expects to get something for nothing, it’s that MITMing your payload is something that feels like a betrayal of trust unless you are crystal clear that you’re doing it. Considering how many people in these comments are surprised by this, it seems like Cloudflare hasn’t been crystal clear.