Privacy issue with recommended Chrome extension

[ea167]

Hello wonderful NodeJS Team,

On the page https://nodejs.org/en/docs/guides/debugging-getting-started/#chrome-devtools-55
you recommend the Chrome extension "NiM".

Please note that this extension requires to share our email addresses to use the extension (as well as the permission "Read and change all your data on the websites you visit"). This requirement was added recently.

I doubt this is GDPR compliant, and the author does not provide a clear justification of why they require such a private information.

IMHO NodeJS should not recommend extensions with such practices.

[fhemberger]

Hi Eric,

thanks for pointing this out. Indeed, the user's email address is sent back every second to Google Analytics: background.js#L112-L113

This is indeed illegal under European GDPR laws.

[june07]

As the author of NiM I would like to provide some feedback.

@ea167 "This requirement was added recently" is not actually true. Please see my blog post written approximately a year ago about this: http://june07.com/foff/.

Along with being highly rated at the Chrome Web Store, NiM has had the support of many in the Node.js community, including Paul Irish of the Chrome DevTools team https://twitter.com/june07t/status/861664828909264896, and Wes Bos https://twitter.com/wesbos/status/839871332280057857, among others.

As far as data (email addresses) being sent to Google Analytics, I'm unsure of how that is illegal?! And I would love to be pointed in the right direction so as to change anything that in fact needs to be changed to conform to any compliance issues.

I've written NiM out of my love for the Node.js language/community and continue to dedicate my time to the project. MUCH more positive feedback has been received compared to negative and I would very much like the link to NiM be re-enstated such that other Node.js developers can also benefit from using NiM as so many others have.

-Respectfully

[thom4parisot]

GDPR is about providing a choice of consent about data collection.

Collecting a data without asking a user its permission breaks this statement.

One way to make it compliant would be to provide a user option (unchecked by default) and to let the user opt in, with a clear indication of what is the information used for (to be sold, to be processed, to send e-mails, etc.).

[june07]

Following some help from several sources including checking some of the larger Chome Extensions and how they are doing things, I think we are compliant. I'm certainly not a lawyer.

https://termsfeed.com/blog/legal-agreements-chrome-extensions/

https://app.termly.io/document/privacy-policy/04164179-f943-4e87-ac8b-5afd0367dc6c#infocollect

So it's clear, that change was just made and I circled it in green to highlight here.

[june07]

@fhemberger Would be great to get some feedback on this.

For the record, I've compared NiM's Chrome web store page with that of 10 different companies, all of whom have items in Google's Chrome web store, FOUR (EBay, Paypal, Walmart, and LinkedIn, of whom are among "10 Global Companies Using Node.js in Production" according to Google. And none of which I would think the Node.js community would have a problem "recommend"ing if that is what it means to add a link on the https://nodejs.org/en/docs/guides/debugging-getting-started/ page.

I have compiled current pictures of all 10 companies’ chrome web store pages, as well as the privacy policy pages for each of the 5 which actually have them referenced, and uploaded them to Google photos (see link below). As far as the other 5, there are a number of valid reasons why they may not have privacy policy links, just as NiM did not, but I don’t want to digress.

https://photos.app.goo.gl/y4TN5dT1JeNbED2KA

I can say with strong conviction that data collected by NiM is minuscule by every measure when compared to that collected by these larger companies. Further, no data has ever been used for ill purposes and will not ever deviate from that found in our new privacy policy (link again: https://app.termly.io/document/privacy-policy/04164179-f943-4e87-ac8b-5afd0367dc6c#infocollect) And again, @ea167’s statement that “this requirement was added recently.” is simply NOT the case as can be determined by reading the GitHub project history.
THIS is where/when the extra permissions were added on Feb 9, 2017, close to 2 years ago. As the removal was partly predicated on that statement, I bring it up again.

I do regret not having a privacy policy in place sooner. To my defense, unlike these larger organizations, I don’t really have spare man/woman power to go around. That said, the focus for me has been on trying to make NiM great for the betterment of like-minded Node.js developers. I should point out that I make zero monetary gain from NiM, and it is a side project for me.

So, if they weren’t before, I believe that all of the bases are now covered. I would like to get the Chrome web store link for NiM back and would be more than happy to submit a PR for such.

Please advise...

-Respectfully to all

[eyedean]

I guess it wouldn't hurt to mention here too that this issue is back -- see #1923 (comment).

Shall we reopen this issue?

[ChALkeR]

@fhemberger what do you think should be done here?

[fhemberger]

Honestly I'm a bit disappointed this issue is back. I thought we came to an understanding here, @june07. And it can't be the job of the website team to continuously check for violations of privacy regulations of third-party tools listed on the website. (as listing could also be interpreted as endorsement of those tools.)

In this case I'm in favor of removing this extension permanently from the nodejs.org website. Thoughts, @nodejs/website?