On 23rd November, ConsenSys shared an update to its privacy policy to all of its users, which included updated clauses in the policy to clearly communicate what information is being collected and how it is used. Specifically, (i) the addition of contact details of our recently appointed Data Protection Officer as required by Article 13 GDPR; and (ii) clarity in relation to the information collected by Infura when users use Infura as their default RPC provider in MetaMask. We believe in transparency and want to ensure all users know what we are collecting and how it is being used, including what is collected by the MetaMask wallet versus what is collected by a wallet service provider. 

The updates to the policy do not result in more intrusive data collection or data processing, and were not made in response to any regulatory changes or inquiries. Our policy has always stated that certain information is automatically collected about how users use our Sites, and that this information may include IP addresses. When users interact with Ethereum or other blockchains — such as by sending a transaction or requesting a balance — through an RPC provider such as Infura, the provider receives both the user’s IP and wallet address to provide the service. This is not Infura-specific and is consistent with how web architecture works generally, though we continue to pursue technical solutions to minimize this exposure, including anonymization techniques. 

As more users are exploring non-custodial ways to hold their crypto assets, the updates to our policy were made in an effort to educate users about how MetaMask works, including highlighting its use of Infura as the default RPC provider in MetaMask and users’ ability to use their own Ethereum node as an alternative to the default RPC provider. Users may also use a third party RPC provider with MetaMask, but the updated policy makes clear users should be aware their information will be subject to whatever information collection performed by the RPC provider they are using and the terms of the RPC provider regarding their use of the data they do collect.