Audacity refutes 'spyware' accusations after privacy policy update

Popular audio editing program Audacity is trying to clear up recent accusations that it's now "spyware" after recent changes to its privacy policy. Even so, many users remain unconvinced.

On July 2, Audacity updated its privacy policy to state that it will now collect users' "personal data" for analytics and to improve their software. Such data includes their operating system and its version, their IP address (thus their country), and their CPU. All of this came as a rude shock to users, who had been utilising the free audio editing software without giving up data since its launch over two decades ago.

However, it didn't stop there. The new privacy policy also states that Audacity may collect "Data necessary for law enforcement, litigation and authorities’ requests (if any)" — a categorisation vague and large enough to cause users significant concern. Data may also be shared with third parties such as law enforcement agencies, advisors, and potential buyers.

Users have been vocally expressing their displeasure at these updates, accusing Audacity of being "spyware" and speculating that it could monitor their microphones. Now Audacity has attempted to clarify its intentions.

This Tweet is currently unavailable. It might be loading or has been removed.

This Tweet is currently unavailable. It might be loading or has been removed.

This Tweet is currently unavailable. It might be loading or has been removed.

"We believe concerns are due largely to unclear phrasing in the Privacy Policy, which we are now in the process of rectifying," said Muse Group's head of strategy Daniel Ray in a statement on GitHub. Muse Group acquired Audacity in May, and had assured users at the time that the software would remain free and open source. "We will be publishing a revised version shortly."

According to Ray, Audacity "[does] not and will not sell ANY data [it] collect[s] or share it with 3rd parties. Full stop." However, this seemed to directly contradict the privacy policy's initial statement that it may disclose personal data to "a potential buyer" or "any competent law enforcement body... or other third party."

Speaking to Mashable via email, Ray clarified that Audacity will in fact share data with third parties, but only in specific circumstances.

"[W]e share data with buyers of the company (there are no buyers of the data since we never sell any data), but any buyer can only use this data for the conditions set out in the privacy policy," Ray told Mashable.

He further stated that Audacity would not share any information to law enforcement upon mere request, and would have to be compelled by a court of law to do so.

"This means that we will actually deny a law enforcement request unless there is a court order, not that we are actively sharing data with law enforcement," Ray said.

Ray's GitHub post also clarified that the only data Audacity collects is users' IP address, which is anonymised and becomes irretrievable after 24 hours, as well as their operating system version and CPU type. Users can also manually send data in error reports, but this is optional.

"We do not collect any additional data beyond the points listed above for any purpose," said Ray. "We will not collect or provide any information other than data described above with with [sic] any government entity or law enforcement agency."

These policy changes aren't anything other programs haven't implemented before, but their unexpected addition to open-source stalwart Audacity understandably has users on edge — particularly as it has been undergoing other significant changes as well.

"Audacity has transitioned from being an entirely volunteer effort to the primary contributors for future releases being a dedicated product team (designers, developers, project management, testing, etc.) engaged by Muse," Ray told Mashable, estimating that in-house contributions to Audacity are expected to sit at around 85 percent.

Released in 2000, Audacity has been downloaded 100 million times and is the go-to program for anyone starting to dabble in audio editing. Few people likely thought it would ever start gathering user data, and despite Ray's explanation, many remain convinced it's an unnecessary overreach.

Fortunately, there's no need to despair if Audacity's reassurances still don't feel particularly comforting to you. Ray noted that the new privacy policy will only come into effect with version 3.0.3, Audacity's next update, and previous versions will continue not to collect any data.

"The current version (3.0.2) does not support data collection [of] any data of any kind and has no networking features enabled," said Ray in his post.

So if you grab Audacity now, you'll still be able to use it completely anonymously — provided you never update.

UPDATE: July 15, 2021, 10:08 a.m. AEST This article has been updated with comment from Muse Group's Daniel Ray.