Remove tracking of data from ClassicPress sites

[discobot]

As discussed in slack (about woocommerce tracking users sensible data) I would like to see removed unecessary data tracking from ClassicPress, such as:

https://github.com/ClassicPress/ClassicPress/blob/1.0.1+dev/src/wp-includes/update.php#L93-L94

I think we can just collect statistical data needed for serving updates/troubleshooting, in an anonymous way.

Also I would like to see the enforcing of rules limiting data plugins can collect.

#remove feature

---

Read-only archive: GitHub · Where software is built

Author: Elisabetta Carrara (Emc2)

Vote count: 33

Status: Completed (1.4.0)

---

Comments

Link to Slack discussion: Slack

I’m happy to remove these two specific values (blog and user count) at any time. We don’t need them, and the queries that generate these numbers can actually be very slow on large sites.

I think we can just collect statistical data needed for serving updates/troubleshooting, in an anonymous way.

Yes, this is exactly what we do.

We do need to be able to track active ClassicPress sites, along with the versions of ClassicPress, PHP, and MySQL the site is running. We also monitor for errors with the upgrade process. All of this is done anonymously without storing any personally identifiable information.

~ posted by James Nylen

There is a difference between ‘want’ and ‘need’. I run lots of software that does not need to call home. That should not be any different for a blog software, just because it is online.

~ posted by Rob

+1 for doing everything possible to minimise data collection and reduce the (perceived) need for mass telemetry tracking.

~ posted by William Patton

I think we can just collect statistical data needed for serving updates/troubleshooting, in an anonymous way.
Also I would like to see the enforcing of rules limiting data plugins can collect.

Great goals on both counts.

In fact I’d suggest ClassicPress go further in its pledges – not so much focused on being a “Business” CMS per se, but emphasizing:

• non-profit / community driven
• transparency of code / identity / maintainers / relationships / disclosure
• pledges re: no favoritism / pay-to-play / backroom deals
• pledges re: no tracking + strong privacy

Perhaps software like Mozilla could be a good role model.

For example, requiring real names and profile photos for anyone who contributes to the website code or Core code, etc. Imagine how many malware plugins could have been avoided at WordPress.org with such a policy. This is why privacy and transparency often go hand-in-hand…

That said, requiring plugin and theme authors to do XYZ is risky, because you alienate agencies who are trying to earn a living. You also alienate agencies who only offer their extensions via third party sites or homepages. So to be realistic, it might need to apply only to ClassicPress assets.

~ posted by Jesse

[viktor]

I’m happy to remove these two specific values (blog and user count) at any time. We don’t need them, and the queries that generate these numbers can actually be very slow on large sites.

I agree with @james on this. Removing these 2 data points can be a good step to complete this petition.

[viktor]

There is a PR now to remove $blogs and $users from being reported to the ClassicPress sever. This has been scheduled for version 1.4.0. The petition status is planned now.

[ElisabettaCarrara]

Thanks for this.
I forgot I even proposed this change in a petition.
And now it is going to be implemented.
And now more than ever it makes sense with all the upcoming gdpr new restrictions about data and consent.

[viktor]

1.4.0 shipped. So this petition has been completed and will close.