What you need to know
- A software engineer claims that Wacom tablets log every Mac app you open, sending the data to Google Analytics.
- Robert Heaton says he made the discovery after investigating why a drawing tablet needed a privacy policy.
- Specifically, he was drawn to a section that said it would send "aggregate usage data, technical session information and information about [my] hardware device" to Google Analytics.
A software engineer has discovered that Wacom tablets log every Mac app you open, sending the information to Google Analytics.
That's according to Robert Heaton. Over on his blog he wrote:
In section 3.1 of their privacy policy, Wacom wondered if it would be OK if they sent a few bits and bobs of data from my computer to Google Analytics, "[including] aggregate usage data, technical session information and information about [my] hardware device." The half of my heart that cares about privacy sank. The other half of my heart, the half that enjoys snooping on snoopers and figuring out what they're up to, leapt. It was a disjointed feeling, probably similar to how it feels to get mugged by your favorite TV magician.
After some investigation he was able to figure out exactly what data Wacom was recording and sending off to Google Analytics, with some surprising results:
Some of the events that Wacom were recording were arguably within their purview, such as "driver started" and "driver shutdown". I still don't want them to take this information because there's nothing in it for me, but their attempt to do so feels broadly justifiable. What requires more explanation is why Wacom think it's acceptable to record every time I open a new application, including the time, a string that presumably uniquely identifies me, and the application's name.
Heaton notes that Wacom's privacy policy says that Wacom only collects this data for product development purposes, which he believes. However, he said that on principle, one could resent the fact that Wacom was doing it. Secondly, he noted that the practice could actually cause real harm, for example, if a piece of information was recorded about a secret program or sensitive information. He goes on:
We can get more subtle. I personally use Google Analytics to track visitors to my website. I do feel bad about this, but I've got to get my self-esteem from somewhere. Google Analytics has a "User Explorer" tool, in which you can zoom in on the activity of a specific user. Suppose that someone at Wacom "fingerprints" a target person that they knew in real life by seeing that this person uses a very particular combination of applications. The Wacom employee then uses this fingerprint to find the person in the "User Explorer" tool. Finally the Wacom employee sees that their target also uses "LivingWith: Cancer Support".This example is admittedly a little contrived, but it's also an illustration that, even though this data doesn't come with a name and social security number attached, it is neither benign nor inert.
In conclusion, he said:
If you too have a Wacom tablet (presumably this tracking is enabled for all of their models), open up the "Wacom Desktop Center" and click around until you find a way to disable the "Wacom Experience Program". Then the next time you're buying a tablet, remember that Wacom tries to track every app you open, and consider giving another brand a go.
We've reached out to Wacom regarding this. But as Heaton alludes to in his piece, instances like this don't always happen by design and aren't necessarily evidence of malpractice on Wacom's part. It could well be that they were unaware of this, or indeed the extent of the data being collected and sent to Google Analytics.
