ConsenSys, the Ethereum software company, has responded to criticism of its proposed data collection from MetaMask wallet users

According to the latest update, users who set Infura as their default node service provider and remote procedure protocol (RPC) in MetaMask will have their wallet addresses and IP addresses collected.

Despite criticism, ConsenSys maintains in a blog post that the latest MetaMask update does not compromise user anonymity.

“The updates to the policy do not result in more intrusive data collection or data processing and were not made in response to any regulatory changes or inquiries. Our policy has always stated that certain information is automatically collected about how users use our sites, and that this information may include IP addresses.

When users interact with Ethereum or other blockchains – such as by sending a transaction or requesting a balance – through an RPC provider such as Infura, the provider receives both the user’s IP and wallet address to provide the service. This is not Infura-specific and is consistent with how web architecture works generally, though we continue to pursue technical solutions to minimize this exposure, including anonymization techniques.”

ConsenSys claims that the update was intended as a gentle reminder to users that it uses Infura as its default node provider and that the company processes users' data per industry standards. The company also highlights the option for users to switch RPCs within MetaMask.

“As more users are exploring non-custodial ways to hold their crypto assets, the updates to our policy were made in an effort to educate users about how MetaMask works, including highlighting its use of Infura as the default RPC provider in MetaMask and users’ ability to use their own Ethereum node as an alternative to the default RPC provider.

Users may also use a third-party RPC provider with MetaMask, but the updated policy makes clear users should be aware their information will be subject to whatever information collection performed by the RPC provider they are using and the terms of the RPC provider regarding their use of the data they do collect.”