# @SCBuergel: Ledger multisig sends user data to Datadog without consent

Source: https://xcancel.com/scbuergel/status/1982782753025249666
Kiwi News: https://news.kiwistand.com/stories/SCBuergel-Ledger-multisig-sends-user-data-to-Datadog-without-consent?index=0x6901d4ccc70df80613e60c4ba1986c32b28745b6ecee1217dc4d065a1687ea0d77fa75fa
Submitted by misha on 2025-10-29 UTC, 3 upvotes, 0 comments

## Summary

Crypto researcher SCBuergel says the Ledger multisig app sends user data, including Safe addresses, browser metadata, screen resolution and in-app actions, to the analytics firm Datadog, even though he opted out of analytics. He notes that Ledger's privacy policy requires consent for sharing this kind of data and does not mention Datadog, Inc. He also argues that the app still does not let users sign transactions securely, calling the lack of a non-"yolo" signing option reckless, and asks Ledger to do better on privacy.

## Article

I misunderstood the @Ledger multisig announcement the other day. I understood they've decided to charge like a Swiss private bank, but I've only just realized the extent to which they're not actually private at all...

I was also dismayed to see that this is still NOT a Ledger app which actually allows normal people securely sign txs, which was the entire issue in the first place. I refuse to call it "clearsigning". There's just "signing" and "yolo signing", and the ability to not yolo sign is not a premium feature - it's basically functionality without which your product is reckless and irresponsible

But back to the privacy: obviously I opted out of analytics, so imagine my surprise at all the tracker calls which @brave helpfully blocked for me

So what's Ledger trying to share here with the friendly data harvesting technologists at @datadoghq ?
* My personal Safe addresses
* My personal browser metadata
* My personal device metadata (screen resolution)
* My every move that I take on the app

What is this for? Ledger's own privacy policy states that sharing this kind of data requires consent, yet this is happening anyway to a company (Datadog, Inc.) not even mentioned in the privacy policy!

And yes, I fully expect this project will be dead on arrival because of insane pricing. But I'm more concerned that once again a major crypto player like Ledger (and EU based to boot!) doesn't care about basic privacy protection or following the most basic privacy regulations

@Ledger please do better than this, a privacy policy is not just a formality if you are a security company!