The application, acquired by Muse Group in May, is a well-known cross-platform multi-track audio editing software that can be downloaded for free from the developer’s website. Now, there appears to be a catch: the app’s newest update will employ a data-collection mechanism in the software.
A privacy notice published on July 2 informed Audacity users that the application would begin collecting IP addresses, user processor specifics, and operating system information for the purposes of “app analytics,” “improving our app,” and “for legal enforcement.”
Users took issue with the changes given that the once exclusively offline audio editor was now pivoting sharply to data-tracking for presumably commercial purposes just months after it was acquired. Muse Group, which now owns Audacity, is itself owned by the Russia-based company WSM Group.
Because the company’s data servers are housed within the European Economic Area, the collection must comply with the European Union’s General Data Protection Regulation standards. However, the privacy update specified that while users’ personal data would be kept secure, the company is “occasionally required to share [user’s] personal data with [Audacity’s] main office in Russia and our external counsel in the USA.”
Audacity’s privacy notice specifies that the company does not sell the personal information it collects from its users. Further, the notice states users maintain the right to obtain what categories of personal information Audacity does collect, sell or disclose to third parties or law enforcement.
“We have put in place appropriate safeguards [which includes the European Commission’s Standard Contractual Clauses] to ensure that whenever your personal data is transferred outside the EEA to countries that are not deemed adequate by the European Commission, your personal data receives an adequate level of protection in accordance with the GDPR,” the text of the privacy notice read.
In its privacy notice, the company maintains it has legal grounds for processing the information under its “legitimate interest” in ensuring the app functions properly, but also for the purpose of WSM Group “[defending] its legal rights and interests.”
Previously, Audacity developers walked back plans to introduce “basic telemetry” software to their product. Telemetry software remotely transmits user and engagement data from third-party hosts, usually for measuring business metrics or for error detection and diagnostics. Although the telemetry software for Audacity would have been strictly optional and disabled by default, Martin Keary, head of design at MuseScore, said on GitHub that the plans had been dropped and the company would instead self-host its software for reporting errors and issuing updates.
Although Muse Group still has no plans to change Audacity’s open-source format, the company did announce it would open the door for new code contributors by introducing a Contributor License Agreement. “Open-source software” refers to computer programs and operating information in which the software’s copyright holder grants users access to its basic source code – enabling them to access, view and modify the code at their own discretion. New code contributors will have to sign and abide by Audacity’s CLA if they wish to contribute to new features.