/etc/update-motd.d/50-motd-news is in violation of the GDPR

[tastytea]

/etc/update-motd.d/50-motd-news periodically makes a connection to motd.ubuntu.com and sends an User-Agent containing: “curl/$curl_ver $lsb $platform $cpu $uptime cloud_id/$cloud_id” (together with the IP address, obviously).

While it can be argued that the checking for important messages (for things like “Heartbleed“ etc.) is necessary, the expressive User-Agent clearly is not. It is illegal (and potentially costly) to store any personally identifiable data that is not absolutely necessary without informed consent.

This problematic behaviour is known since at least 2017: <https://bugs.launchpad.net/ubuntu/+source/base-files/+bug/1701068>.

Note that the fact that it can be disabled does not help. If you want to collect this kind of data, you need informed consent.

Why not just let curl use the default User-Agent?

Please explain why you use this User-Agent, if you store it, if you store the IP address and for how long. And if you store anything, stop.

[Steve Langasek (vorlon)]

Software versions on a computer do not identify a person. At no point is the data from the user agent associated with a person. Therefore this is not personally identifying information under the GDPR.

When Canonical collects personally identifying information, it is done with user consent, in compliance with the GDPR.

[tastytea (tastytea)]

So, the IP address is not stored, not even in logs?

You haven't explained why you need all that information. I get that $lsb and $platform may be necessary to inform about serious bugs.

* Why do you have me send $cpu?
* Why do you have me send $uptime?
* What is $cloud_id?