Link to the code that reproduces this issue
https://github.com/bulwarkmail/webmail
To Reproduce
- Start the application in dev mode (npm run dev)
- Look at the output
Result:
Attention: Next.js now collects completely anonymous telemetry regarding usage.
This information is used to shape Next.js' roadmap and prioritize features.
You can learn more, including how to opt-out if you'd not like to participate in this anonymous program, by visiting the following URL:
https://nextjs.org/telemetry
I am here in a personal role, but I work for a data protection supervisory authority, so I can provide the following information:
Reading information from an end user's device is not permitted in the EU unless the end users specifically request it and have given their voluntary and fully informed consent. This is clearly not the case here.
In other words: It is not allowed to collect telemetry data (unless the end user specifically requests it).
Where personal data is involved (IDs, device IDs, hashes of device IDs, UUIDs, user IDs, hashes of user IDs, MAC addresses, IP addresses, random IDs, etc.; see Article 4 no. 1 GDPR), this may result in fines of up to 20 million euros or up to 4% of global annual turnover, whichever is higher.
If only non-personal data is collected, the amount of the potential fine depends on the relevant national regulations.
For more information see:
https://lfdi-bw.de/edpb-53-guideline
https://lfdi-bw/tracking
Current vs. Expected behavior
Expected behavior: No information is transmitted to any server.
Provide environment information
This is not dependent on the environment, but for completion I provide the output on next info on my production server:
npx --no-install next info
/usr/home/bulwark/webmail/node_modules/next-intl/node_modules/@swc/core/binding.js:333
throw new Error('Failed to load native binding', { cause: loadErrors })
^
Error: Failed to load native binding
at Object.<anonymous> (/usr/home/bulwark/webmail/node_modules/next-intl/node_modules/@swc/core/binding.js:333:11)
at Module._compile (node:internal/modules/cjs/loader:1854:14)
at Object..js (node:internal/modules/cjs/loader:1985:10)
at Module.load (node:internal/modules/cjs/loader:1577:32)
at Module._load (node:internal/modules/cjs/loader:1379:12)
at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
at Module.<anonymous> (node:internal/modules/cjs/loader:1600:12)
at mod.require (/usr/home/bulwark/webmail/node_modules/next/dist/server/require-hook.js:79:28)
at require (node:internal/modules/helpers:153:16)
at Object.<anonymous> (/usr/home/bulwark/webmail/node_modules/next-intl/node_modules/@swc/core/index.js:49:17) {
[cause]: [
Error: Cannot find module './swc.freebsd-x64.node'
Require stack:
- /usr/home/bulwark/webmail/node_modules/next-intl/node_modules/@swc/core/binding.js
- /usr/home/bulwark/webmail/node_modules/next-intl/node_modules/@swc/core/index.js
at Module.<anonymous> (node:internal/modules/cjs/loader:1500:15)
at /usr/home/bulwark/webmail/node_modules/next/dist/server/require-hook.js:68:36
at wrapResolveFilename (node:internal/modules/cjs/loader:1071:27)
at defaultResolveImplForCJSLoading (node:internal/modules/cjs/loader:1095:10)
at resolveForCJSWithHooks (node:internal/modules/cjs/loader:1116:12)
at Module._load (node:internal/modules/cjs/loader:1285:25)
at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
at Module.<anonymous> (node:internal/modules/cjs/loader:1600:12)
at mod.require (/usr/home/bulwark/webmail/node_modules/next/dist/server/require-hook.js:79:28)
at require (node:internal/modules/helpers:153:16) {
code: 'MODULE_NOT_FOUND',
requireStack: [
'/usr/home/bulwark/webmail/node_modules/next-intl/node_modules/@swc/core/binding.js',
'/usr/home/bulwark/webmail/node_modules/next-intl/node_modules/@swc/core/index.js'
]
},
Error: Cannot find module '@swc/core-freebsd-x64'
Require stack:
- /usr/home/bulwark/webmail/node_modules/next-intl/node_modules/@swc/core/binding.js
- /usr/home/bulwark/webmail/node_modules/next-intl/node_modules/@swc/core/index.js
at Module.<anonymous> (node:internal/modules/cjs/loader:1500:15)
at /usr/home/bulwark/webmail/node_modules/next/dist/server/require-hook.js:68:36
at wrapResolveFilename (node:internal/modules/cjs/loader:1071:27)
at defaultResolveImplForCJSLoading (node:internal/modules/cjs/loader:1095:10)
at resolveForCJSWithHooks (node:internal/modules/cjs/loader:1116:12)
at Module._load (node:internal/modules/cjs/loader:1285:25)
at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
at Module.<anonymous> (node:internal/modules/cjs/loader:1600:12)
at mod.require (/usr/home/bulwark/webmail/node_modules/next/dist/server/require-hook.js:79:28)
at require (node:internal/modules/helpers:153:16) {
code: 'MODULE_NOT_FOUND',
requireStack: [
'/usr/home/bulwark/webmail/node_modules/next-intl/node_modules/@swc/core/binding.js',
'/usr/home/bulwark/webmail/node_modules/next-intl/node_modules/@swc/core/index.js'
]
}
]
}
Node.js v24.16.0
Which area(s) are affected? (Select all that apply)
Runtime
Which stage(s) are affected? (Select all that apply)
next dev (local), next start (local)
Additional context
Software developers may find it interesting to collect such information. As a software developer I also find it interesting to know when, how, and how often users are using my software.
However, this is an absolute no-go in security-sensitive environments, and is not permitted in any other cases either, for good reason.
This is a bug. Not nice to have.
Link to the code that reproduces this issue
https://github.com/bulwarkmail/webmail
To Reproduce
Result:
I am here in a personal role, but I work for a data protection supervisory authority, so I can provide the following information:
Reading information from an end user's device is not permitted in the EU unless the end users specifically request it and have given their voluntary and fully informed consent. This is clearly not the case here.
In other words: It is not allowed to collect telemetry data (unless the end user specifically requests it).
Where personal data is involved (IDs, device IDs, hashes of device IDs, UUIDs, user IDs, hashes of user IDs, MAC addresses, IP addresses, random IDs, etc.; see Article 4 no. 1 GDPR), this may result in fines of up to 20 million euros or up to 4% of global annual turnover, whichever is higher.
If only non-personal data is collected, the amount of the potential fine depends on the relevant national regulations.
For more information see:
https://lfdi-bw.de/edpb-53-guideline
https://lfdi-bw/tracking
Current vs. Expected behavior
Expected behavior: No information is transmitted to any server.
Provide environment information
Which area(s) are affected? (Select all that apply)
Runtime
Which stage(s) are affected? (Select all that apply)
next dev (local), next start (local)
Additional context
Software developers may find it interesting to collect such information. As a software developer I also find it interesting to know when, how, and how often users are using my software.
However, this is an absolute no-go in security-sensitive environments, and is not permitted in any other cases either, for good reason.
This is a bug. Not nice to have.