SEBASTIAN SCHMIDT: This will not backfire.
[LAUGHTER]
JEN PERSON: And that's when it all went downhill.
SEBASTIAN SCHMIDT: Yup.
SPEAKER: This is scene 1, take 1, mark.
JEN PERSON: Hey, all you Firebase
developers, welcome to another episode of #Ask Firebase,"
the show where we answer your burning Firebase questions.
I'm Jen Person, your host.
And today is a very special episode
because I have two co-hosts here.
I have Sebastian and Rachel.
And go ahead and tell me a little bit about what
it is that you do here.
SEBASTIAN SCHMIDT: Yeah, I'm Sebastian.
And I work on SDKs for Firebase, mostly on Firestore.
But I also do work for the real time database and the storage
SDKs.
RACHEL MYERS: I'm Rachel.
I work on Firebase security rules.
JEN PERSON: Great.
So this is super exciting.
I'm having you on the show today to talk about GDPR, right?
And sort of broadly, privacy.
Because this issue comes up all the time
every day with Firebase.
And I'm really not an expert in this area.
I wouldn't say that--
we're probably none of us are experts in this area.
RACHEL MYERS: None of us are lawyers.
JEN PERSON: None of us are lawyers.
So this isn't any sort of legal advice.
But I think it really does touch upon some
of the really common questions that we
see with how to use Firebase, you know,
in a way that is secure and private and compliant
with something like GDPR, right?
RACHEL MYERS: That's it.
SEBASTIAN SCHMIDT: Yeah.
JEN PERSON: You ready to answer some questions?
SEBASTIAN SCHMIDT: Yes, of course.
RACHEL MYERS: Yup.
JEN PERSON: Awesome.
So our first question is that--
I optimized the structure of my data
for the reads I would need to support the UI.
And now that makes it pretty difficult
to find and remove user data.
What are my options?
RACHEL MYERS: This is a pretty common use case.
The thing that you could do is start
maintaining an index of the location of a user's data.
So in the same database they're already using,
when you complete, say, a right to--
like, say a user creates a profile.
Now you're going to write to a new place in your database
the location of that profile information.
And then when a user requests that you export their data
to them, or that they need to delete all of their data,
you can go look at that list of all the locations
of their data.
JEN PERSON: Wow.
That makes a lot of sense.
This could sort of fall under the kind of denormalization
that we do a lot of times with the real time database in Cloud
Firestore, right?
Where we're-- it might sort of look a little bit like
you're repeating data.
But in this case, you're keeping a list
of where that other data is.
RACHEL MYERS: Right.
SEBASTIAN SCHMIDT: But you also need
to make sure that as you're denormalizing
this data, if you're deleting user data,
you need to delete this index as well.
JEN PERSON: Yes.
SEBASTIAN SCHMIDT: So it gets--
the more data you store, the trickier it gets.
JEN PERSON: Oh, that makes a lot of sense.
Yeah.
So if you're denormalizing it, you
have to remove it from all those different locations,
and then at the end, also remove the index to it.
RACHEL MYERS: Yup.
JEN PERSON: Wow.
You ready for another question?
RACHEL MYERS: Let's do it.
JEN PERSON: All right.
If I delete data from a Firebase backend, what happens?
SEBASTIAN SCHMIDT: That's actually a pretty tough
question to answer correctly.
So we'll be really weak, and then
if users are more interested, there's
lots of information about this on our website,
and there are white papers to explain the different stages
of deletion in Google Cloud.
JEN PERSON: So we don't just take, like, a single, like,
CD-ROM that has their information on it.
And like--
RACHEL MYERS: We take it out, and we break that CD-ROM.
JEN PERSON: Throw it in the garbage?
There's just a garbage bag full of them.
RACHEL MYERS: So in practice, it's complicated.
Because there are backups and there are caches.
And in order for all those-- like,
we don't want to delete things from backups
immediately, right?
You want a little time because maybe you have to restore data.
So removing data from every place that we store data
is a pretty involved process.
That's why it takes a little bit of time.
SEBASTIAN SCHMIDT: Yeah.
So deletion usually propagates in stages.
And every product publishes how long
it takes for data to actually get deleted once you
issue the call to delete data.
So if you're offering your users the ability
to delete their data, you also need to take that into account.
And you can't promise them that the data is immediately gone.
JEN PERSON: Right.
I'm learning so much already.
This is great.
Where do I find a list of the regulations
that Firebase complies with?
SEBASTIAN SCHMIDT: The best source
is probably our user privacy page
that we've linked to here on this video.
And if you scroll, it's an entire page
that tells you about the data we store, our retention policies.
And it also has a list of all the different government
regulations that each product complies with.
JEN PERSON: There's a lot there, right?
SEBASTIAN SCHMIDT: Yeah.
I'm still trying to digest it.
JEN PERSON: Digest that alphabet soup.
Our next question came to us from Twitter.
And we have an indie developer who wants to know about,
you know, complying with GDPR and Google Analytics.
Do you have any advice for them on how
GDPR works with Google Analytics for Firebase?
RACHEL MYERS: Yeah.
So if you are using Google Analytics,
then you should know that there's
some data that we are collecting for every user on every app
install.
And we list all that information on our privacy terms.
If you want to get consent from your users
to collect that kind of data, you should look at those terms.
And then you should inform your users
about whatever it is that you want
to draw attention to there.
JEN PERSON: Cool.
And I know we'd been talking earlier.
And I sort of asked about GDPR and how
that does or doesn't relate to where your data is stored.
And I'm sort of confused about that.
Does GDPR mean that you have to store
a user's data in the country in which they're located?
RACHEL MYERS: There are lots of privacy regulations.
GDPR does not specifically-- well, I'm not a lawyer.
I'll tell you my engineering understanding of this.
GDPR does not specify anything about the locality of data.
But what it does-- but there are other regulations that do that.
And so if you have questions about where your data will
be stored, we make all that available
in our privacy and security terms.
JEN PERSON: OK.
Good to know.
So yeah, again, we'll have those linked below
so you can check out and really figure out where our data is
located and can be located.
And the Firebase console gives you
some options on that as well.
SEBASTIAN SCHMIDT: And if you're creating a new Firestore
project now, for example, we ask you
where you want your data located.
So if you want to use our European data centers,
that is an option.
JEN PERSON: Yeah.
Good to know.
That was a great rollout that we had.
RACHEL MYERS: Hopefully getting better all the time.
JEN PERSON: Yes.
Was there anything else that you really
want people to know about Firebase with GDPR and privacy?
RACHEL MYERS: I think the number one takeaway
is to start designing for GDPR, which means designing-- or not
specifically GDPR-- but designing for user privacy
from the beginning.
If you're starting a new feature with the idea
that you'll eventually want to delete the data,
you'll probably model your data differently
than if you're only focusing on how to support your clients.
So bring that in as an initial design constraint.
JEN PERSON: Yeah.
That's a really good point.
Because I think one of the benefits of Firebase is it
makes it really simple to spin up something quickly.
But at the same time, you can't spend too much time
thinking about your data structure.
I think it's so important between privacy
and deleting data, and also looking at security rules.
Really spending the extra time up front
to develop that design structure, I think,
will save you development time.
RACHEL MYERS: Right.
JEN PERSON: Down the road.
RACHEL MYERS: We've tried to make it easier for people.
We've released some functions that
will help you delete data and help you export data.
JEN PERSON: We'll link this below.
So do we have any examples to get people
started with user privacy?
SEBASTIAN SCHMIDT: I think a good example to look at
is Friendly Pix.
It's an app that is open source for web, iOS, and Android.
It uses the data model that makes it really easy
to delete user data.
And we actually regularly delete user data every 30 days.
It also has some consent flows built in.
So if users are interested in how to build their own consent
flows, and what wording they can use,
what UI components they should use,
they can also take a look at the open source implementation.
JEN PERSON: Nice.
Yeah.
So Friendly Pix is a great place to start
because it-- and it really is like a full fledged app.
So if you ever have questions about how a lot of things
can really work and what would be like an app
that you would, say, publish to the app store
or to the play store, this gives you
all the different details of it, including things like privacy.
So that's really exciting.
So we got lots of great links for you to check out.
We love to talk about all those things on the show.
But we try to keep things brief.
And these topics can go really deep.
And when it comes to privacy, it's
so niche to wherever you're located.
Like you said, the rules are different,
and there's all sorts of different things
you can comply with.
So definitely check out those links below and check out
all the resources that we have.
So tell me, how did you get involved in GDPR?
RACHEL MYERS: I think we got involved
because we both individually care about user privacy.
Like, it was something that was important to us.
And so when this was a thing that needed some work,
we both jumped on this opportunity
to make user privacy more accessible to everybody
that's building on Firebase.
SEBASTIAN SCHMIDT: And we recently
also talked about user privacy at the Firebase
Summit in Prague.
JEN PERSON: Oh, nice.
SEBASTIAN SCHMIDT: If users are more interested in this,
they can take a look at our talk.
JEN PERSON: Yeah.
So there's a whole talk on this.
And we can link to that.
And it's on the Firebase YouTube channel
showing some of this information and probably a little different
information about GDPR privacy as well.
RACHEL MYERS: Yeah.
JEN PERSON: Thank you both so much for coming on the show
and talking about this topic, especially
because it's something I know nothing about.
So it's great to have people on that have, you know,
done the work so I don't have to.
RACHEL MYERS: Hopefully, we're making it easy for everybody.
JEN PERSON: Yeah, and if you have questions about privacy,
about GDPR, I want excuses to bring them back on the show.
So be sure to post those questions on social media
and hit them with the hashtag #AskFirebase.
And who knows?
Maybe we'll be back answering your question.
Thanks so much for watching, and we'll
see you on a future episode.
GDPR!
RACHEL MYERS: It was awkward with three people.
JEN PERSON: Yeah.
I feel like every kid's show in the '90s
would have ended with like, yeah!
RACHEL MYERS: Oh, yeah.
We all jump in the middle and freeze.