Given the scale of the drama, you'd assume that it was something nefarious, but it isn't. iD loads images for brands from Facebook, and nothing more: here's the relevant code https://github.com/osmlab/name-suggestion-index/blob/66412f0...
Fun story from back in the day: we added 'social share' buttons to iD. Knowing the fundamentals of web security, they were implemented as simple links, with no JavaScript component on the iD side, no 'trackers', nothing of the sort. But some buzz came out about how other Facebook trackers were up to no good, and the OSM community got in a tizzy about how we had installed nefarious tracking devices in the codebase, and after a few days someone recommended that we should implement the buttons as simple links, which is precisely what they were in the first place. That combination of bad faith and nobody reading the code was constant.
It is of course a privacy leak, but there's not actually pushback on addressing that, just not a time machine to go back and fix it already. So there will be a privacy policy notifying users of potential third party data accesses and an option to turn that stuff off.
Adding a Mothercare shop on OSM shouldn't result in Facebook showing you baby/pregnancy adverts, but here we are.
Re: displaying brand logos in the editor and retrieving these online and mainly from Facebook. There are a lot of reasons why this is problematic, not the least that it violates EU privacy regulation without prior consent of the users
I'd like to understand what the issue is here. I'm assuming it isn't just a matter of grabbing a logo (jpg) from Facebook. I assume iD is sending (meta) data about the person who is simply browsing the map to Facebook (i.e. without disclosing that info is being sent or what data is sent)?