Software engineer Robert Heaton discovered that Wacom’s drawing tablets track the name of apps you open on your Mac along with the time and a string that could be used to identify you.
As if that weren’t enough, Wacom appears to be sending that captured information to Google Analytics. The problem is, this is all done without user consent.
Robert Heaton, writing on his blog:
Last week I set up my tablet on my new laptop. As part of installing its drivers I was asked to accept Wacom’s privacy policy.
Being a mostly-normal person, I never usually read privacy policies. Instead, I vigorously hammer the Yes button in an effort to reach the game, machine or medical advice on the other side of the agreement as fast as possible.
But Wacom’s request made me pause. Why does a device that is essentially a mouse need a privacy policy? I wondered. Sensing skullduggery, I decided to make an exception to my anti-privacy-policy-policy and give this one a read.
In section 3.1 of their privacy policy, Wacom wondered if it would be OK if they sent a few bits and bobs of data from my computer to Google Analytics. Wacom didn’t say exactly what data they were going to send themselves. I resolved to find out.
While we expect to eventually hear an apology or some kind or a reasonable explanation from Wacom, this won’t change the fact that this kind of data collection is unacceptable. The right way to do this would be to present the user with a prompt asking for their explicit permission.
Although Wacom’s privacy policy does spell out that the company only collects this data to improve its products, Robert goes on to explain that the User Explorer tool in Google Analytics could be used to zoom in on the activity of a specific user.
Suppose that someone at Wacom ‘fingerprints’ a target person that they knew in real life by seeing that this person uses a very particular combination of applications. The Wacom employee then uses this fingerprint to find the person in the User Explorer tool. Finally the employee sees that their target also uses ‘LivingWith: Cancer Support.’
This is yet another reminder that our digital lives are spied upon, with vast amount of data collected without our knowledge. It’s been proven over and over again that even benign data like apps you launch on your device can be paired with other sources to track or identify us.
In Wacom’s example, Robert has found out that their data collection doesn’t include just the application’s name and the time, but also “a string that presumably uniquely identifies me”.
Fortunately, you can opt-out of Wacom’s tracking by launching the Wacom Desktop Center app, then disable the feature labeled with the text “Wacom Experience Program”.
How do you feel about Wacom’s data collection?
Let us know in the comments down below!