Wow, I'm really disappointed by that in Next.js. I love the product, and I'm sure they're being ethical about what they collect and how they track it, but I deploy this on my production servers. The idea of them doing stuff on my production instances that I'm not aware of and don't approve of is not pleasant. Not to say it's fine if it's on personal machines, because I don't think that is either, but yeah.

The telemetry runs when you call next dev, so does not run on your production instances.

(And you can opt-out and they display a warning, tough of course that is indeed not an opt-in.)

The fact developers even have to worry about that is a problem. How do you know where they will draw that line?

I agree that it's annoying that you can't just plug any tool into your code and hope that it does not do malicious things, but alas, that's the world we live in.

Offering opt-out is odd from a GDPR standpoint.

If the next.js project is collecting ip addresses together with this info they are processing personal data under GDPR. They need to do so under one of the 6 bases for processing, which in their case is either consent or legitimate interest. If consent, opt-in is required and opt-out is a violation. If legitimate interest then opt-out is alright and in fact not even required, but they have a high bar for clearing that standard, especially since opt-out is offered (which somewhat disproves the claim of legitimate interest).

I assume the project is in non-compliance and one complaint to a regulatory authority away from a proceeding that may lead to a fine if they don’t switch to an opt-in model.

In this case I mainly wanted to assuage concerns that this affected production instances.

That said, I'm not sure if consent or legitimate interest are the only potentially applicable bases. Knowing when the software breaks so you can fix it seems like it might be in the data subject's interest. And if it's not PII (which I'm not sure it's not, given that an IP address can be exposed, even if not logged), those bases aren't even necessary.

What I really really want is to have distros push for a centralized place for telemetry opt-out - something like /etc/telemetry.conf or ~/.config/telemetry.conf - and force all applications to either make telemetry opt-in or honor this config (perhaps patching the applications and submitting the patches upstream)

"They're talking about telemetry in tools comonly used to build webapps, which is perhaps more surprising."

Why might it be suprising. Rather than guess, curious what's in mind.