Skip to content

Illegal collection of data #94475

@alvar-freude

Description

@alvar-freude

Link to the code that reproduces this issue

https://github.com/bulwarkmail/webmail

To Reproduce

  1. Start the application in dev mode (npm run dev)
  2. Look at the output

Result:

Attention: Next.js now collects completely anonymous telemetry regarding usage.
This information is used to shape Next.js' roadmap and prioritize features.
You can learn more, including how to opt-out if you'd not like to participate in this anonymous program, by visiting the following URL:
https://nextjs.org/telemetry

I am here in a personal role, but I work for a data protection supervisory authority, so I can provide the following information:

Reading information from an end user's device is not permitted in the EU unless the end users specifically request it and have given their voluntary and fully informed consent. This is clearly not the case here.

In other words: It is not allowed to collect telemetry data (unless the end user specifically requests it).

Where personal data is involved (IDs, device IDs, hashes of device IDs, UUIDs, user IDs, hashes of user IDs, MAC addresses, IP addresses, random IDs, etc.; see Article 4 no. 1 GDPR), this may result in fines of up to 20 million euros or up to 4% of global annual turnover, whichever is higher.
If only non-personal data is collected, the amount of the potential fine depends on the relevant national regulations.

For more information see:
https://lfdi-bw.de/edpb-53-guideline
https://lfdi-bw/tracking

Current vs. Expected behavior

Expected behavior: No information is transmitted to any server.

Provide environment information

This is not dependent on the environment, but for completion I provide the output on next info on my production server:

npx --no-install next info
/usr/home/bulwark/webmail/node_modules/next-intl/node_modules/@swc/core/binding.js:333
    throw new Error('Failed to load native binding', { cause: loadErrors })
          ^

Error: Failed to load native binding
    at Object.<anonymous> (/usr/home/bulwark/webmail/node_modules/next-intl/node_modules/@swc/core/binding.js:333:11)
    at Module._compile (node:internal/modules/cjs/loader:1854:14)
    at Object..js (node:internal/modules/cjs/loader:1985:10)
    at Module.load (node:internal/modules/cjs/loader:1577:32)
    at Module._load (node:internal/modules/cjs/loader:1379:12)
    at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
    at Module.<anonymous> (node:internal/modules/cjs/loader:1600:12)
    at mod.require (/usr/home/bulwark/webmail/node_modules/next/dist/server/require-hook.js:79:28)
    at require (node:internal/modules/helpers:153:16)
    at Object.<anonymous> (/usr/home/bulwark/webmail/node_modules/next-intl/node_modules/@swc/core/index.js:49:17) {
  [cause]: [
    Error: Cannot find module './swc.freebsd-x64.node'
    Require stack:
    - /usr/home/bulwark/webmail/node_modules/next-intl/node_modules/@swc/core/binding.js
    - /usr/home/bulwark/webmail/node_modules/next-intl/node_modules/@swc/core/index.js
        at Module.<anonymous> (node:internal/modules/cjs/loader:1500:15)
        at /usr/home/bulwark/webmail/node_modules/next/dist/server/require-hook.js:68:36
        at wrapResolveFilename (node:internal/modules/cjs/loader:1071:27)
        at defaultResolveImplForCJSLoading (node:internal/modules/cjs/loader:1095:10)
        at resolveForCJSWithHooks (node:internal/modules/cjs/loader:1116:12)
        at Module._load (node:internal/modules/cjs/loader:1285:25)
        at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
        at Module.<anonymous> (node:internal/modules/cjs/loader:1600:12)
        at mod.require (/usr/home/bulwark/webmail/node_modules/next/dist/server/require-hook.js:79:28)
        at require (node:internal/modules/helpers:153:16) {
      code: 'MODULE_NOT_FOUND',
      requireStack: [
        '/usr/home/bulwark/webmail/node_modules/next-intl/node_modules/@swc/core/binding.js',
        '/usr/home/bulwark/webmail/node_modules/next-intl/node_modules/@swc/core/index.js'
      ]
    },
    Error: Cannot find module '@swc/core-freebsd-x64'
    Require stack:
    - /usr/home/bulwark/webmail/node_modules/next-intl/node_modules/@swc/core/binding.js
    - /usr/home/bulwark/webmail/node_modules/next-intl/node_modules/@swc/core/index.js
        at Module.<anonymous> (node:internal/modules/cjs/loader:1500:15)
        at /usr/home/bulwark/webmail/node_modules/next/dist/server/require-hook.js:68:36
        at wrapResolveFilename (node:internal/modules/cjs/loader:1071:27)
        at defaultResolveImplForCJSLoading (node:internal/modules/cjs/loader:1095:10)
        at resolveForCJSWithHooks (node:internal/modules/cjs/loader:1116:12)
        at Module._load (node:internal/modules/cjs/loader:1285:25)
        at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
        at Module.<anonymous> (node:internal/modules/cjs/loader:1600:12)
        at mod.require (/usr/home/bulwark/webmail/node_modules/next/dist/server/require-hook.js:79:28)
        at require (node:internal/modules/helpers:153:16) {
      code: 'MODULE_NOT_FOUND',
      requireStack: [
        '/usr/home/bulwark/webmail/node_modules/next-intl/node_modules/@swc/core/binding.js',
        '/usr/home/bulwark/webmail/node_modules/next-intl/node_modules/@swc/core/index.js'
      ]
    }
  ]
}

Node.js v24.16.0

Which area(s) are affected? (Select all that apply)

Runtime

Which stage(s) are affected? (Select all that apply)

next dev (local), next start (local)

Additional context

Software developers may find it interesting to collect such information. As a software developer I also find it interesting to know when, how, and how often users are using my software.

However, this is an absolute no-go in security-sensitive environments, and is not permitted in any other cases either, for good reason.

This is a bug. Not nice to have.

Metadata

Metadata

Assignees

No one assigned

    Labels

    RuntimeRelated to Node.js or Edge Runtime with Next.js.

    Type

    No fields configured for Bug.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions