Blockchain software firm ConsenSys is clarifying a recent update to its terms of service about the collection of data from users of MetaMask, the flagship non-custodial wallet for Ethereum (
The recent update that Infura, one of ConsenSys’ main products, will collect certain data like wallet and IP address of users who designate it as their default node service provider and remote procedure protocol (RPC) in MetaMask.
Facing some backlash, ConsenSys says in a blog post that the new update does not weaken the privacy of METAMASK users.
“The updates to the policy do not result in more intrusive data collection or data processing, and were not made in response to any regulatory changes or inquiries. Our policy has always stated that certain information is automatically collected about how users use our sites, and that this information may include IP addresses.
When users interact with Ethereum or other blockchains – such as by sending a transaction or requesting a balance – through an RPC provider such as Infura, the provider receives both the user’s IP and wallet address to provide the service. This is not Infura-specific and is consistent with how web architecture works generally, though we continue to pursue technical solutions to minimize this exposure, including anonymization techniques.”
ConsenSys says that its update was more of a reminder to users about how their data is processed and its use of Infura as the default node provider. The firm also notes that users can select a different RPC within MetaMask.
“As more users are exploring non-custodial ways to hold their crypto assets, the updates to our policy were made in an effort to educate users about how MetaMask works, including highlighting its use of Infura as the default RPC provider in MetaMask and users’ ability to use their own Ethereum node as an alternative to the default RPC provider.
Users may also use a third-party RPC provider with MetaMask, but the updated policy makes clear users should be aware their information will be subject to whatever information collection performed by the RPC provider they are using and the terms of the RPC provider regarding their use of the data they do collect.”
