Do I need to get user consent to use TelemetryDeck?

[virtualrapha]

Hi,

a colleague of mine recently told me, that according to GDPR, I'm required to collect active user consent if I'm using an analytics service in my app, even if it's a GDPR-compliant, privacy-first one like TelemetryDeck. Is this really true? Currently, my app has a setting to opt out of analytics with TelemetryDeck, but I'm not explicitly asking for consent. Is this a violation of GDPR?

[winsmith]

According to the best of my knowledge, you don't need GDPR user consent to collect data using TelemetryDeck. This is because none of the data we collect counts as Personally Identifiable Information (PII), and PII is the only kind of data that is regulated by GDPR. In other words, GDPR is about user data, and our data is not user data.

[virtualrapha]

But in theory you could collect IP addresses (I know you don't), which (to the best of my knowledge) count as PII, right? As a user of your analytics package, I could look at the source code of the client SDK, but I can't look at the server-side code. So I can't guarantee that you aren't collecting PII server-side. I guess it's a grey area and probably needs a resilient statement from a lawyer.

[winsmith]

That's correct. We don't collect IP addresses, and our privacy policy states that, but in a zero-trust-world, you can't guarantee that. What we can offer is on the technical side that you run all your signal through a proxy before forwarding them to us, and on the legal side that you'll see in our data processing agreements that if we DO break GDPR by e.g. collecting IP addresses, it's not on you, it's on us.