Login
You're viewing the mstdn.degu.cl public feed.
  • GrapheneOSGrapheneOS@grapheneos.social
    Aug 1, 2025, 3:51 PM

    @leeloo @Life_is @CoMaps

    > The GDPR is quite clear that only opt in is legal.

    Network-based location using Wi-Fi APs publicly broadcasting their SSID is legal in the EU under GDPR.

    > Your repeated "everyone else is doing it" doesn't hold.

    That's not the argument for it being legal and ethical. We're pointing out it's strange to focus on us implementing a standard feature most people expect to have. It's used by other alternative Android-based operating systems and also the non-Android ones.

    💬 2🔄 0⭐ 0

Replies

  • GrapheneOSGrapheneOS@grapheneos.social
    Aug 1, 2025, 3:54 PM

    @leeloo @Life_is @CoMaps

    > Everyone else is doing it because they can afford to laugh at a 2 billion EUR fine, just to show that they are evil.

    It's not something specific to large companies such as Apple, Google and Microsoft. The implementation used by desktop Linux distributions with GNOME or KDE is GeoClue:

    gitlab.freedesktop.org/geoclue

    Mozilla used to run their own many of the operating systems without huge usage share were using for this feature:

    wiki.mozilla.org/CloudServices

    💬 2🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Aug 1, 2025, 3:58 PM

    @leeloo @Life_is @CoMaps Most operating systems, browsers, mapping/navigation apps, etc. using it is not the reason why it's legal. It's the reason why focusing on us having support for it is strange. You said this in relation to us supporting a feature other open source mobile and desktop OSes support too:

    > I guess I'll have to strike GrapheneOS off my list of privacy respecting Android versions.

    You don't have to publicly broadcast your Wi-Fi SSID but not doing it isn't really more private.

    💬 0🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Aug 1, 2025, 4:21 PM

    @leeloo @Life_is @CoMaps Regardless of what you think about Mozilla,
    Mozilla's network-based location service was used as the default in GeoClue including for GNOME, KDE and Pantheon (elementary OS) among others. It was also the main location service used in microG by non-GrapheneOS AOSP-based operating systems. We never used it for multiple reasons and decided to work towards building our own implementation with better privacy/usability matching iOS to start with and then full offline support.

    💬 0🔄 0⭐ 0
  • Leelooleeloo@chaosfem.tw
    Aug 1, 2025, 4:13 PM

    @GrapheneOS @Life_is @CoMaps
    SSIDs of private access points are personally identifiable information, much more so than IP adressed (which in most cases would require a warrant to find out who used at a specific time).

    Can you point to anything (law, legal verdicts,...) that say that using personally identifiable information without consent or valid cause is legal under the GDPR?

    Why would it be strange to focus on the one who was supposedly on the good side of the privacy question arguing for the bad side, rather than those who admit to being evil,

    💬 2🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Aug 1, 2025, 4:22 PM

    @leeloo @Life_is @CoMaps No, they're not regarded as personally identifiable information in this context. It's a publicly broadcasting radio station acting as a static landmark. Your opinion on it doesn't match the laws or what's enforced.

    Broadcasting an SSID from a Wi-Fi AP is a choice. The _nomap system didn't need to exist and Apple wasn't breaking any laws by not respecting it. It's just something Google came up with for their own service and others aren't obligated to respect it.

    💬 1🔄 0⭐ 0
  • Leelooleeloo@chaosfem.tw
    Aug 1, 2025, 4:29 PM

    @GrapheneOS @Life_is @CoMaps
    They ARE personally identifiable, way more so than other examples that people do get fined for, even if the lawyers prosecuting these cases haven't caught on.

    Point to an exception in the actual text of the GDPR, or be forever regarded like the lawyers who used to pretend that you could just write "you consent".

    💬 1🔄 0⭐ 0
  • EndlessMasonEndlessMason@hachyderm.io
    Aug 1, 2025, 5:00 PM

    @leeloo @GrapheneOS @Life_is @CoMaps

    gdpr.eu/article-4-definitions/
    > ‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier

    So the question is, can you tell it's me just because I'm the only one who has ever connected to the "E Masons iphone" access point, or the "Masonland" SSID at my home?

    💬 0🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Aug 1, 2025, 5:03 PM

    @EndlessMason @leeloo @Life_is @CoMaps It's only the SSID, MAC and position estimate which are used as part of mapping APs with publicly broadcast SSIDs. Clients and APs without a public SSID are not included in the data. It's not only not considered PII by the EU but the EU has a mandatory standard incorporating Wi-Fi based positioning:

    etsi.org/deliver/etsi_ts/10360

    Every smartphone sold in the EU is required to implement this standard for emergency call locations which includes Wi-Fi positioning.

    💬 1🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Aug 1, 2025, 5:05 PM

    @EndlessMason @leeloo @Life_is @CoMaps Claiming that it's illegal to build a Wi-Fi positioning database in the EU is claiming that Wi-Fi positioning is illegal in the EU. That's quite an extraordinarily claim when the EU is expecting every smartphone to provide location data explicitly based on Wi-Fi positioning data when making emergency calls. The intention is that when making an emergency call, GNSS, Wi-Fi based positioning, etc. are used even if they were off prior to the emergency call.

    💬 1🔄 0⭐ 0
  • EndlessMasonEndlessMason@hachyderm.io
    Aug 1, 2025, 5:23 PM

    @GrapheneOS I dunno, emergency services using that data to tell them exactly where my phone is located ... kinda sounds personally identifiable

    It also feels like mashing 112 while bleeding is a pretty clear and explicit consent to the processing of that data

    @leeloo @Life_is @CoMaps

    💬 0🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Aug 1, 2025, 6:21 PM

    @EndlessMason @Life_is @CoMaps The consent @leeloo has been talking about is from Wi-Fi AP owners, not the user with the device. Emergency calls don't change this at all.

    Network location is very explicitly opt-in on GrapheneOS. It's partially opt-in even on Google Mobile Services Android devices through it being disabled by default with a toggle that's enabled by default during the initial setup wizard. It's opt-out for iOS where it also didn't have a toggle until relatively recently.

    💬 0🔄 0⭐ 0
  • C.Suthorn :prn:Life_is@no-pony.farm
    Aug 1, 2025, 4:26 PM
    @leeloo@chaosfem.tw @GrapheneOS@grapheneos.social @CoMaps@floss.social

    SSID of APs are not PII in the same way as car license plates are not PII. The owner of an AP decides the SSID. It can be "Donald Trump" or "Mouse on the Moon", or anything. And the owner of the AP can change the SSID every minute.

    (But then, if you use your phone in the train and try to connect to the train public AP, your phone will first show you SSIDs like "Friedrich Merz offizielles iPhone", "CEO of SAP on Android", "Marias Samsung Galaxy S4", "Do not enter".)

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Aug 1, 2025, 4:42 PM

    @leeloo @Life_is @CoMaps SSID and MAC of a publicly broadcasting Wi-Fi AP are not considered PII on their own and making a database is legal. The EU is literally funding building open source projects related to this. You're treating what open source operating systems and the EU government themselves are doing as illegal without justifying it. It's clear you don't like it and think it shouldn't be legal, but that doesn't mean it's illegal under the GDPR. This is even part of the Wi-Fi standards.

    💬 2🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Aug 1, 2025, 4:45 PM

    @leeloo @Life_is @CoMaps Modern Wi-Fi routers assist with mapping and location detection via Wi-Fi RTT and other features. It's part of the service they're intended to provide. By running a Wi-Fi AP with a publicly broadcasting AP, you're offering a publicly available location detection service.

    The main addition in en.wikipedia.org/wiki/IEEE_802 was Wi-Fi positioning support. This is part of IEEE 802.11ax also known as Wi-Fi 6 so it's a standard feature on modern Wi-Fi routers. It's not unintended.

    💬 1🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Aug 1, 2025, 4:54 PM

    @leeloo @Life_is @CoMaps The EU has a ETSI TS 103 625 standard for emergency calls which is mandatory for ALL smartphones sold in the EU. It standardizes using Wi-Fi based positioning as part of location detection for emergency calls. See here:

    etsi.org/deliver/etsi_ts/10360

    It's not only legal to do this in the EU but it's expected to be done. It's literally a core part of a standard that's mandatory to implement in the EU. It would be a broken system if it was illegal to make the database it needs.

    💬 1🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Aug 1, 2025, 9:45 PM

    @leeloo @Life_is @CoMaps They aren't being inconsistent about this. It's permitted to map Wi-Fi APs. It's expected and pretty close to required as part of compliance with the regulations for emergency calls too.

    💬 0🔄 0⭐ 0
  • Leelooleeloo@chaosfem.tw
    Aug 1, 2025, 6:36 PM

    @GrapheneOS @Life_is @CoMaps
    My justification is that it is just as much PII as a my address, the only difference is that it was collected wirelessly, which makes your argument boil down to "the GDPR does not apply to data collected wirelessly".

    But the real problem is that even if the GDPR did not exist, you should not be arguing for collecting personally identifiable data without consent. That's in the realm of big tech companies with "be evil" ss their motto.

    Please don't be like them.

    💬 1🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Aug 1, 2025, 9:44 PM

    @leeloo @Life_is @CoMaps Your address is publicly mapped. The location of your address is easy to look up in a database. Having a map/database of addresses mapped to locations is not a privacy issue. The same thing applies to a statically located Wi-Fi AP which is not being moved around as long as you're not putting anything sensitive in the SSID name. It's only a privacy issue when an AP is moved while having the same SSID or MAC. It's a privacy issue regardless of what we do with this.

    💬 2🔄 0⭐ 0