Muse Group to Revise Audacity Privacy Policy Following ‘Spyware’ Uproar

KALININGRAD, Russia — Public outcry over privacy policy changes to the open-source digital audio editor and recording application Audacity culminated in its parent company, Muse Group, clarifying how it intends to utilize user data.

The application, acquired by Muse Group in May, is a well-known cross-platform multi-track audio editing software that can be downloaded for free from the developer’s website. Now, there appears to be a catch: the app’s newest update will employ a data-collection mechanism in the software.

A privacy notice published on July 2 informed Audacity users that the application would begin collecting IP addresses, user processor specifics, and operating system information for the purposes of “app analytics,” “improving our app,” and “for legal enforcement.”

Users took issue with the changes given that the once exclusively offline audio editor was now pivoting sharply to data-tracking for presumably commercial purposes just months after it was acquired. Muse Group, which now owns Audacity, is itself owned by the Russia-based company WSM Group.

Because the company’s data servers are housed within the European Economic Area, the collection must comply with the European Union’s General Data Protection Regulation standards. However, the privacy update specified that while users’ personal data would be kept secure, the company is “occasionally required to share [user’s] personal data with [Audacity’s] main office in Russia and our external counsel in the USA.”

Audacity’s privacy notice specifies that the company does not sell the personal information it collects from its users. Further, the notice states users maintain the right to obtain what categories of personal information Audacity does collect, sell or disclose to third parties or law enforcement.

“We have put in place appropriate safeguards [which includes the European Commission’s Standard Contractual Clauses] to ensure that whenever your personal data is transferred outside the EEA to countries that are not deemed adequate by the European Commission, your personal data receives an adequate level of protection in accordance with the GDPR,” the text of the privacy notice read.

In its privacy notice, the company maintains it has legal grounds for processing the information under its “legitimate interest” in ensuring the app functions properly, but also for the purpose of WSM Group “[defending] its legal rights and interests.”

Previously, Audacity developers walked back plans to introduce “basic telemetry” software to their product. Telemetry software remotely transmits user and engagement data from third-party hosts, usually for measuring business metrics or for error detection and diagnostics. Although the telemetry software for Audacity would have been strictly optional and disabled by default, Martin Keary, head of design at MuseScore, said on GitHub that the plans had been dropped and the company would instead self-host its software for reporting errors and issuing updates.

Although Muse Group still has no plans to change Audacity’s open-source format, the company did announce it would open the door for new code contributors by introducing a Contributor License Agreement. “Open-source software” refers to computer programs and operating information in which the software’s copyright holder grants users access to its basic source code – enabling them to access, view and modify the code at their own discretion. New code contributors will have to sign and abide by Audacity’s CLA if they wish to contribute to new features.

“As mentioned in the Compliance with Law Enforcement above, we take steps so that the IP address we collect is non-identifiable after 24 hours,” Daniel Ray, head of strategy for Muse Group, said in a written statement published on GitHub. “We do understand that unclear phrasing of the Privacy Policy and lack of context regarding introduction has led to major concerns about how we use and store the very limited data we collect. We will be publishing a revised version shortly.”

Ray continued, “In the meantime, the Privacy Policy doesn’t actually come into force until the next release of Audacity [3.0.3]. The current version [3.0.2] does not support data collection of any data of any kind and has no networking features enabled.”