Wacom defends itself against data harvesting accusations

AppleInsider

Wacom has responded to allegations drivers for its tablet line are collecting data on its users and passing it on to Google, including the names of macOS applications being used, by claiming it has no access to personal data and what data it collects is anonymized before it is seen by the company.

Over the last week, Wacom has been under fire from critics following the discovery its drivers collects data for analysis. On Wednesday, developer Robert Heaton published his research on the drivers, performed after discovering Wacom requires users to accept a privacy policy to install drivers for its tablets.

The privacy policy itself mentioned the sending of data to Google Analytics, including "aggregate usage data, technical session information, and information about the hardware device." Examination of the data it sends includes some standard stuff including details of when the driver started or was shut down, but also when applications are opened, including the name of the software and what appeared to be a unique identifier to that driver installation.

In its response, Wacom understands "user concerns" over the data that is sent out as part of its Wacom Experience Program. The company is quick to highlight how it is an optional part of the installation that doesn't affect how the drivers function if it is declined, something that was pointed out in the original research.

"We apologize for any confusion regarding data collection being done by the Wacom software driver," the firm states, "and the unclarity about the actual information collected."

Wacom claims it collects data "for quality insurance and development purposes only," with the driver collecting a "sample of information" such as the model, hardware usage, and the names of apps. The company does not collect MAC addresses nor serial numbers.

While data is collected through Google Analytics, while Google does collect the IP address, Wacom does not have access to that data. Google Analytics is also said to anonymize the data before Wacom receives it.

As for how the data is interpreted, Wacom's development and customer care teams can "review across all aggregated users of a product," such as the most common function settings for pen buttons or the most frequently viewed tabs in Wacom apps.

"We ave no access to personal data," the statement continues. "We cannot relate to any specific users as the data is anonymized and aggregated. We do not know who users are as individuals and cannot see what users are creating or doing in third-party software applications."

Wacom then underlines the response by declaring it is "committed to protect the privacy of its users, partners, and customers across all touch points."

The harvesting of consumer data has become a big issue over time, as companies attempt to earn more money from each user by collecting valuable data for sale to other firms.

In one recent example, antivirus firm Avast was found to be collecting data on its users and selling it on to marketing firms. In the case of one marketing firm, it paid Avast over $2 million for access to an "insight feed" which included URL strings and demographic data.

wonkothesane

No, they don’t “understand” user concerns. Otherwise they would not have done it in the first place. They simply don’t care. One word: disgusting. 

polymnia

My complaint isn’t so much the collection of the data mentioned above. If it is what they claim, I’d be inclined to allow it. What I really don’t like is that the Wacom software insists on setting itself to auto-launch every time it’s updated and spawns a nag window. Every. Single. Reboot. 

Wish they’d spend some time thinking of the user experience. 

mr lizard

Typical ‘non apology’. Here’s what it should have said:

”We apologise for not being fully transparent about the data we collect and why. We will now update our privacy policy wording to make it explicitly clear so that our customers can be fully informed before opting in. We have also taken the step of opting out all customers from whom we were collecting data, as we accept that they weren’t able to make an informed choice based on our previous privacy policy wording.”

CloudTalkin

mr lizard said:

Typical ‘non apology’. Here’s what it should have said:

”We apologise for not being fully transparent about the data we collect and why. We will now update our privacy policy wording to make it explicitly clear so that our customers can be fully informed before opting in. We have also taken the step of opting out all customers from whom we were collecting data, as we accept that they weren’t able to make an informed choice based on our previous privacy policy wording.”

Opt-in should be the default setting for data collection from any company.  Period.  Unfortunately, we ( the people) don't collectively care enough about data collection for companies to change their habits.  They know, by and large, we just want to get to doing what we want to get to doing.  The quickest way to get to the stuff we want is to agree to everything and opt out later.  Later tends to be forgotten.

Until we as a society act at a level that rises above lip service filled with rhetoric, we're going to continue to get these stories where companies retroactively apologize for not being as clear as they could have been.  They all tend to follow the old adage that it's better to ask for forgiveness than permission.

robjn

The fact is Wacom don’t ‘collect anonymized data’.

The Wacom software collects and sends raw data to Google. Google processes it and lets Wacom see some of that data in an anonymized form.

I’m more concerned about Google snooping on me than Wacom.

dysamoria

The Wacom spokesperson seems to not be a native English speaker. Mixing up “insurance” and “assurance” is something even native speakers do (as demonstrated in the film “2001”), but “unclarity” isn’t even a word. If these are the language skills used to write their policies and policy descriptions, I can see why there is ... “unclarity”.

I’m not in any way knocking ESL speakers. I’m a monolingual myself. Anyone speaking more than one language is doing more than I am. What I am getting at is that companies need to use experts in/for each language they choose for business communications, both internally and externally.

mpantone

I predict that Wacom's current stance will be considered inadequate and insincere by privacy advocates, eventually resulting in a halt to the data collection and a more substantial apology issued by the company's PR department.

The company is a high risk for a class action lawsuit at this point.

Pity, I enjoy my Wacom Intuos tablet, even if it is only lightly used. 

I won't stop using it completely but I am disappointed.

wonkothesane

mr lizard said:

Typical ‘non apology’. Here’s what it should have said:

”We apologise for not being fully transparent about the data we collect and why. We will now update our privacy policy wording to make it explicitly clear so that our customers can be fully informed before opting in. We have also taken the step of opting out all customers from whom we were collecting data, as we accept that they weren’t able to make an informed choice based on our previous privacy policy wording.”

And how many people would bring back their Wacom upon reading this at home after unpacking? I remember times when you’d install a driver (in particular for a paid for product) and it did just that: drive.  You simply don’t expect such software to have this additional “function”. 

sorryusername

You can go with tablets from XP-Pen.com instead. They do not log anything in regard to what you do. 

Their quality is high and price is very acceptable. 

No, we do not track or log our users' usage of the apps or anything through the driver or anything downloaded from our website. Our user's privacy is a concern of ours and there is no need to track anything of what they are doing or using.

GG1

robjn said:

The fact is Wacom don’t ‘collect anonymized data’.

The Wacom software collects and sends raw data to Google. Google processes it and lets Wacom see some of that data in an anonymized form.

I’m more concerned about Google snooping on me than Wacom.

Can you use Little Snitch to find out the port that Wacom is using, and then block it?

CloudTalkin

sorryusername said:

You can go with tablets from XP-Pen.com instead. They do not log anything in regard to what you do. 

Their quality is high and price is very acceptable. 

No, we do not track or log our users' usage of the apps or anything through the driver or anything downloaded from our website. Our user's privacy is a concern of ours and there is no need to track anything of what they are doing or using.

Careful.  You're advocating for XP-Pen based on a false assumption.  To be fair, they may be a great company, but what you're praising (They do not log anything in regard to what you do) simply isn't true.  So that I'm clear, I'm not saying XP-Pen did anything wrong.  I am saying you misinterpreted what you read and drew and incorrect conclusion.

That excerpt you quoted is about the driver only, not XP-Pen as a whole (as your claim implies).  Their privacy policy https://www.xp-pen.com/page/Privacy_Policy.html provides better clarity.  Relevant excerpt:

C. DISCLOSURE OF PERSONAL DATA
We may disclose and transfer your Personal Data to our partners and to service providers engaged by us to assist us to provide services to you or who otherwise process Personal Data for purposes described in this Privacy Policy or notified to you when we collect your Personal Data.  Examples of these partners or service providers include:
marketing platforms, such as, but not limited to, Google, Twitter, Facebook and Instagram, and providers of analytics services relating to users’ behavior, in order to tailor the content you see when visiting our Site.  These marketing platforms may combine information they collect on our Site with data on their platforms and data they collect from other websites or through other sources in order to conduct targeted advertising.  The activities of these third party marketing platforms are governed by their own privacy policies, not this Privacy Policy;

Does any of this sound similar to what Wacom discloses?  When companies make claims about privacy it's always best to see what their privacy policy says instead of relying on cleverly worded releases.  To be even more fair, XP-Pen and Wacom are not alone in their data sharing.  You can look at the privacy policy of almost any of your favorite companies and find the exact same thing.  

DAalseth

Woah, back the train up a second.
Why is a graphics tablet collecting ANYTHING? 
Too D*** many devices and software packages from too D*** many developers just assume they can grab whatever data they want.
There is NO reason a graphics tablet driver does ANYTHING but make the tablet work. Nothing. 

sorryusername

XP-Pen do not track you when you are using their drawing tablet or software. They do not log you apps, launches or configurations. 

What you are linking to, is about when you visit them on their website, Twitter, FB et al when they and the rest of the world log their users. 

CloudTalkin said:

sorryusername said:

You can go with tablets from XP-Pen.com instead. They do not log anything in regard to what you do. 

Their quality is high and price is very acceptable. 

No, we do not track or log our users' usage of the apps or anything through the driver or anything downloaded from our website. Our user's privacy is a concern of ours and there is no need to track anything of what they are doing or using.

Careful.  You're advocating for XP-Pen based on a false assumption.  To be fair, they may be a great company, but what you're praising (They do not log anything in regard to what you do) simply isn't true.  So that I'm clear, I'm not saying XP-Pen did anything wrong.  I am saying you misinterpreted what you read and drew and incorrect conclusion.

That excerpt you quoted is about the driver only, not XP-Pen as a whole (as your claim implies).  Their privacy policy https://www.xp-pen.com/page/Privacy_Policy.html provides better clarity.  Relevant excerpt:

C. DISCLOSURE OF PERSONAL DATA
We may disclose and transfer your Personal Data to our partners and to service providers engaged by us to assist us to provide services to you or who otherwise process Personal Data for purposes described in this Privacy Policy or notified to you when we collect your Personal Data.  Examples of these partners or service providers include:
marketing platforms, such as, but not limited to, Google, Twitter, Facebook and Instagram, and providers of analytics services relating to users’ behavior, in order to tailor the content you see when visiting our Site.  These marketing platforms may combine information they collect on our Site with data on their platforms and data they collect from other websites or through other sources in order to conduct targeted advertising.  The activities of these third party marketing platforms are governed by their own privacy policies, not this Privacy Policy;

Does any of this sound similar to what Wacom discloses?  When companies make claims about privacy it's always best to see what their privacy policy says instead of relying on cleverly worded releases.  To be even more fair, XP-Pen and Wacom are not alone in their data sharing.  You can look at the privacy policy of almost any of your favorite companies and find the exact same thing.  

fulwild

As to he why a tablet wants to know what programs you are using, I think that would be to see what programs its use sears are using. That would be important information if you want to make your product more useful to your users. 

As Robin pointed out the fact that Wacom passes the raw data to Google does is not mitigated by the fact that they get less complete data back.