Only if they make it clear what they’re taking in return.
It seems like almost no one in these comments was aware of this, they announced it but that announcement apparently didn’t reach most free customers. Cloudflare can do what they want, but now a bunch of people (myself included) trust them less and are less excited to recommend their paid products.
Because paying business customers are a lot more sensitive to this type of change rolling out. They are particular about how they want their shit hosted. Which is totally fair. People on the free tier probably a lot more interested in free benefits and care less about a little change in their hosting.
Cloudflare needs the data. Useful to validate the impact of changes, build marketing content... Using the free tier for this is fair, they let you opt out, they give you a dashboard.
If someone is mad, maybe they should pay or use a different architecture.
I don’t think anyone in these comments expects to get something for nothing, it’s that MITMing your payload is something that feels like a betrayal of trust unless you are crystal clear that you’re doing it. Considering how many people in these comments are surprised by this, it seems like Cloudflare hasn’t been crystal clear.
> this is fair, they let you opt out, they give you a dashboard
So they give you something else you didn't ask for and therefor it's "fair"? I think it's pretty dubious to extend services with such data collecting features without informing affected users first, and making it clear how to opt-out before its deployment. A blog post won't do, no.
> Makes me wonder if their stuff is GDPR-compliant without consent.
GDPR service providers and partners do not have to consent. Consent is for the users.
Services providers have to tell you when they collect your data, and they will most likely fail to do that if they don't even know their partner injects code.
*So you're liable if you host on cloudflare.*
Now, they somehow avoid this :
>when enabling Web Analytics, you can choose to drop requests from European and UK visitors if you so desire (listed here specifically), meaning we will not collect any RUM metrics from traffic that passes through our European and UK data centers. The version of Web Analytics that will be enabled by default excludes data from EU visitors (this can be changed in the dashboard if you want).
By default, it is only enabled for visitors from out of the EU, like so many services that respect your privacy and your concerns are their first priority
Even on free tiers there are Terms of Use you'll need to agree to as a user of their services. Like I said, it's dubious to alter a service and collect data without informing the user first, free tier or not.
There's a reason I got emails from LinkedIn regarding its new AI training purposes, and they made it clear how to opt-out and provided a deadline. I'm on a free tier there as well. So I'd question the legality of this even before any discussions about GDPR enter the picture.
> They are not collecting and using your personal data.
Do you see how GDPR doesn't apply, then? ...you're contradicting yourself.
I'd still question the legality of the data collection by altering the offered service without properly informing the affected users. Whether GDPR applies doesn't matter, and whether it's a free tier service doesn't matter either. You're a consumer of Cloudflare, so any consumer rights apply.
As a website owner, you are responsible towards your users for data collection (your architectural choices, your responsibility). This was my concern on GDPR.
Sibling comment says data collection is disabled in EU.
I never said "they would violate GDPR". I was questioning if it could be the case. Someone said it's not the case as the feature is turned off in EU. Reading their blog, it also looks like they don't collect much identifiable data.
When selecting free tier of such commercial MITM, opt-in RUM data collection is really far from the top ethical concern. I'm not saying it's a good thing and I'm not deploying their solutions to my websites.
I'm not a Cloudflare customer and don't intend to actually use their services. To be transparent I got a free account for few experiments. I'm not working for them in any way.
When it's free you know you are being used, collecting data is the game.
Just guessing.
* Cloudflare is giving you a "free" service - they'd like something in return. Seems reasonable to me
* Paid customers are usually business that have different needs, on average, than free customers
> Seems reasonable to me
Only if they make it clear what they’re taking in return.
It seems like almost no one in these comments was aware of this, they announced it but that announcement apparently didn’t reach most free customers. Cloudflare can do what they want, but now a bunch of people (myself included) trust them less and are less excited to recommend their paid products.
I have broadly good feelings about Cloudflare but this warrants a response.
Because paying business customers are a lot more sensitive to this type of change rolling out. They are particular about how they want their shit hosted. Which is totally fair. People on the free tier probably a lot more interested in free benefits and care less about a little change in their hosting.
Cloudflare needs the data. Useful to validate the impact of changes, build marketing content... Using the free tier for this is fair, they let you opt out, they give you a dashboard.
If someone is mad, maybe they should pay or use a different architecture.
I don’t think anyone in these comments expects to get something for nothing, it’s that MITMing your payload is something that feels like a betrayal of trust unless you are crystal clear that you’re doing it. Considering how many people in these comments are surprised by this, it seems like Cloudflare hasn’t been crystal clear.
> this is fair, they let you opt out, they give you a dashboard
So they give you something else you didn't ask for and therefor it's "fair"? I think it's pretty dubious to extend services with such data collecting features without informing affected users first, and making it clear how to opt-out before its deployment. A blog post won't do, no.
You are not paying and it's a business. They need to get something from this deal and they'll maximize it: marketing, data, upselling...
Collecting RUM and giving you the opportunity to turn it off is not that bad for a free service.
Makes me wonder if their stuff is GDPR-compliant without consent. If not, then ok, maybe that's bad to turn it on by default.
> Makes me wonder if their stuff is GDPR-compliant without consent.
GDPR service providers and partners do not have to consent. Consent is for the users.
Services providers have to tell you when they collect your data, and they will most likely fail to do that if they don't even know their partner injects code.
*So you're liable if you host on cloudflare.*
Now, they somehow avoid this :
>when enabling Web Analytics, you can choose to drop requests from European and UK visitors if you so desire (listed here specifically), meaning we will not collect any RUM metrics from traffic that passes through our European and UK data centers. The version of Web Analytics that will be enabled by default excludes data from EU visitors (this can be changed in the dashboard if you want).
By default, it is only enabled for visitors from out of the EU, like so many services that respect your privacy and your concerns are their first priority
Even on free tiers there are Terms of Use you'll need to agree to as a user of their services. Like I said, it's dubious to alter a service and collect data without informing the user first, free tier or not.
There's a reason I got emails from LinkedIn regarding its new AI training purposes, and they made it clear how to opt-out and provided a deadline. I'm on a free tier there as well. So I'd question the legality of this even before any discussions about GDPR enter the picture.
They are not collecting and using your personal data. To me (IANAL), it looks really different from LinkedIn.
GDPR is about legality and covers the LinkedIn case you mention.
> They are not collecting and using your personal data.
Do you see how GDPR doesn't apply, then? ...you're contradicting yourself.
I'd still question the legality of the data collection by altering the offered service without properly informing the affected users. Whether GDPR applies doesn't matter, and whether it's a free tier service doesn't matter either. You're a consumer of Cloudflare, so any consumer rights apply.
GDPR very much applies.
As a website owner, you are responsible towards your users for data collection (your architectural choices, your responsibility). This was my concern on GDPR.
Sibling comment says data collection is disabled in EU.
Cool, so you went from
> Cloudflare needs the data. [...] If someone is mad, maybe they should pay or use a different architecture.
To "they would violate GDPR".
Are you ok with that behavior then? And are you basing your ethical decision solely on the current legislation?
I never said "they would violate GDPR". I was questioning if it could be the case. Someone said it's not the case as the feature is turned off in EU. Reading their blog, it also looks like they don't collect much identifiable data.
When selecting free tier of such commercial MITM, opt-in RUM data collection is really far from the top ethical concern. I'm not saying it's a good thing and I'm not deploying their solutions to my websites.
Shill
I'm not a Cloudflare customer and don't intend to actually use their services. To be transparent I got a free account for few experiments. I'm not working for them in any way.
When it's free you know you are being used, collecting data is the game.
Because if something is free, you are the product.