Measurement Lab Privacy Policy

Active and previous versions

Measurement Lab Data Collection Overview

Measurement Lab (M-Lab) is a measurement platform that provides one of the largest collections of public data on Internet performance. The data is generated by users that voluntarily conduct tests (or “experiments”) either directly through the M-Lab site or through third party “clients,” which are software applications or hardware equipment instrumented with software applications that test the connection between the user and an M-Lab server. The experiments may be authored, designed and maintained by parties other than M-Lab, e.g. university research groups or third party developers.

All experiment data is retained indefinitely and published publicly to support research into trends in Internet performance.

Please check this policy before you submit any data to the M-Lab platform through a test or client.

What is under the scope of this Privacy Policy?

This privacy policy covers data collected from you by Measurement Lab when you visit our website, engage with us directly (email, phone), or when you run an M-Lab hosted test via websites maintained by M-Lab, or via a software client provided by M-Lab such as our Chrome browser extension or client code compiled from our code repositories, hereafter referred to as “software client”.

For anyone using our tests in the EU, references are explicitly made to the General Data Protection Regulation (GDPR) but this policy applies regardless of the country you are using our services from. We are data controllers (GDPR Art.4.7) insofar as we determine the means and purposes of the data collected and made public under our test methodology (further “test data”). For running tests developed by third-party researchers (further “experimenters”), we recommend reading the privacy policy found on their website. Links to experimenters’ websites can be found on our pages describing each M-Lab hosted test. All M-Lab hosted tests are listed on our listed on our tests page.

Software clients developed by third parties using open source test(s) provided by M-Lab, and/or which leverage the M-Lab platform as a service, must comply with this privacy policy, as well as the M-Lab Acceptable Use Policy, with respect to the submission of test data to M-Lab. Third party software clients that add additional non-M-Lab services or collect additional data from the user are not allowed to submit such data to M-Lab. Therefore, entities developing third party software clients are responsible for maintaining appropriate policies for any such additional data or services they collect.

Who we are and why we do what we do.

Measurement Lab (further “M-Lab”) is a fiscally sponsored project of Code for Science & Society (CS&S) operating at 3439 SE Hawthorne Blvd. #247, Portland, Oregon 97214-5048.

Purpose of the processing of personal data

M-Lab provides an open source platform hosting Internet measurement tests developed by researchers (hereafter referred to as experimenters), allowing individuals to test various aspects of the Internet service to which they have access. Concurrently, it allows experimenters to develop code and conduct analysis using their purpose built software client. For a full list of experimenters that have developed their software client on our software solution, please visit our tests page

M-Lab was developed to promote scientific, transparent, economics-and-politics-free analysis of Internet performance. To achieve this, we believe that scientific independence requires the resulting data to be made available to the wider public as raw data and allow for it to be queried with no limitation of time. This entails storing data forever. As a consequence we collect and make your data public under the legitimate interest basis for processing under GDPR.

M-Lab’s datasets are one of the only publicly available data sources on Internet performance, and therefore are unique with respect to our claim of legitimate interest. We release all of the data collected through experiments into the public domain under an OSI-approved license. M-Lab waives all copyright and related rights in and to the experiment data. Everyone is free to use the open experiment data.

We encourage third parties to make use of this data for research and other projects, illustrative examples of which are detailed on our publications page and data tools page. Third parties may use the experiment data for any purpose, without needing to seek prior permission from M-Lab. M-Lab cannot assert control over third parties’ use of the published data.

M-Lab uses data directly for the following purposes:

  • Research: M-Lab may directly use aggregated experiment data to conduct research related to Internet performance.
  • Aggregation of data: We aggregate experiment data to support analysis internally and by third parties. To improve the transparency and usability of data we may also produce visualizations that display experiment data patterns for a particular region or ISP.
  • Maintenance and improvement of the M-Lab Platform: We may also use the information we collect to maintain and support our platform and presence, including troubleshooting issues, optimizing our website, or making decisions about how to expand our server network.
  • Operation of the M-Lab Platform: We may use the information we collect to operate experiments associated with the M-Lab platform, including directing a client to an appropriate server on the platform.
  • Abuse Detection and Troubleshooting: We may use information we collect to detect, prevent, or otherwise addressing abuse, security, or technical issues with the M-Lab Platform.
  • Legal Purposes: We may use data we collect to enforce legal claims, including investigation of potential violations of applicable Acceptable Use Policies or other legal terms governing your use of the M-Lab platform.

Important: Please note that because our platform’s purpose is to engage in longitudinal data studies, we maintain the data we collect for infinite periods of time. If you are not comfortable with data being retained for an indefinite amount of time, please abstain from using our tests. Read on to find out what data is collected.

What data we collect from you, why we collect it, what happens to it and what rights you may exercise.

As outlined in our Acceptable Use Policy, the following types of data may be collected from you:

  • Data Collected When You Run Tests
    • Measurement Data: Performance variables describing the state of connection during the test, such as average download and upload speed; latency and topology of the path between the client and server; and whether the application or protocol is manipulated or discriminated against in transit.
    • Connection Data: Information necessary to characterize performance data, including the Internet Protocol (IP) address of the client that conducted the measurement and the date and time of the test.
    • Metadata: Descriptive data about the user’s environment to support analysis of measurement data. Metadata varies by experiment and client but may include the name and version of the web browser software, software application, or operating system used to conduct the test.
  • Data Collected for the Performance of M-Lab Operations
    • M-Lab interfaces with a number of third parties in the operation of its platform, including for the purposes of contracting and operations for server infrastructure and transit and maintaining measurement experiments. M-Lab may collect contact data from these parties including name, email, address, and telephone number and retain and use this contact data for as long as is necessary to provide the platform and for legal purposes. This data will not be published and will be accessible only to members of the M-Lab team.
    • We refer to this type of data hereafter as “Non-test related data”
  • Information Collected Through the Use Of Our Website
    • We may collect data about how you interact with M-Lab, like when you visit our website, hereafter referred to as “Website related data”. This data may be collected, processed and analyzed using Google Analytics:
      • Log data: When you use M-Lab services or view M-Lab content, we may automatically collect and store certain data in server logs (records of the page requests made when you visit our sites). This may include: details of how you used our platform; Internet protocol address; device event data such as crashes, system activity, hardware settings, browser type, standard HTTP request headers, including but not limited to user agent, referral URL, language preference, date and time; and cookies that may uniquely identify your browser.
      • Cookies and Local Storage: We may use various technologies to collect and store data when you visit the website, and this may include sending one or more cookies or randomly generated identifiers to your device. A cookie is a small file containing a string of characters that is sent to your computer when you visit a website. Cookies may store user preferences and other data. The “help” portion of the toolbar on the majority of browsers will direct you on how to prevent your browser from accepting new cookies, how to command the browser to tell you when you receive a new cookie, or how to fully disable cookies. We may also collect and store data using mechanisms such as browser web storage (including HTML5) and application data caches. For more information about cookies, please see our Cookies Notice.

M-Lab’s platform is internationally distributed and uses cloud services to store and process data, which affects how M-Lab collects and stores data. The initial point of collection for experiment data is the server on the M-Lab platform with which an experiment is conducted.

For a single user, the initial point of collection can differ each time a measurement is made and may or may not be in the user’s country of residence. The data is collected by one of our servers, typically the one nearest to you (this could be a server in the EU). After the initial collection, M-Lab aggregates the data from the servers on the platform, enabling the long-term storage and analysis of the data. Data is stored in M-Lab’s Google Cloud Storage and in BigQuery datasets. Data hosted on the platform may be distributed across multiple countries, which may have differing privacy rules than those in your jurisdiction. We process the data for the purposes of the above described legitimate interests, and by using the M-Lab platform, you agree to such transfer of your data.

Google LLC is certified under the EU-US and Swiss-US Privacy Shield allowing for the transfer of personal data from the EU to the US. Read more about the Privacy Shield at the end of this document.

If you are an individual running a test maintained by M-Lab using one of our default software clients

Measurement Lab maintains some of the tests running on our platform. These include NDT, TCP-INFO, and Traceroute. Of these tests, NDT is the only test directly usable by you, for example running the test from the NDT page on our website, from our standalone speed test site, or using a test version compiled from our public code repositories. TCP-INFO and Traceroute are run as server-side processes to gather data about the TCP connections to our servers.

Measurement data and connection metadata is collected. This includes the IP address of the ISP provided on-premise device, or the IP address of your router, modem, etc. that receives an IP address from your provider. The time of test (timestamp) and the machine environment (e.g.: browser used and operating system) are also collected.

Your rights under the GDPR

As test users, under the GDPR, considering your personal data was collected and processed under the legal basis of legitimate interest, you have the right to access your data. You may request that we provide you with a copy of the data we hold about you. If you contact us by email, you should expect your data to be sent by email. If you would like it to be provided through another medium, please let us know. You have the right to request the rectification of your personal data. You have the right to request the erasure or restriction of your personal data and to object to its processing. In response to an erasure request, M-Lab will anonymise your data, thus taking it out of scope of the GDPR. You have the right to object to automated decision-making and the right to be informed about whether or not your data is subject to automated decision making. Automated decision-making is involved in determining which server is nearest to the location of the device on which the test is run. This decision-making is in no way employed to make decisions which would affect your rights and freedoms. We hereby inform you that should you express the wish to exercise your right to object to automatic decision-making we would apply your right to object and restrict your data from further processing. Please note that the rights above may differ depending on your location, our ability to verify your identity, and any legal exceptions or obligations we may have

Privacy by design and data minimisation when exercising your GDPR rights

Exercising the above-mentioned rights will require you to prove your identity. M-Lab is committed to data privacy and specifically one of its core principles: data minimisation. As such, we will not request a copy of your ID to prove your identity. Because we collect only your IP address at the time the test is run, we have no means of proving the test data belongs to you. Should you wish to exercise the rights listed above, we require proof that this IP address belonged to you at the point in time when you conducted an M-Lab test. Such proof could be provided in the form of a written confirmation from the resource holder (‘owner’) of the IP block your IP address is part of, for example your Internet Service Provider. You can find the details of the resource holder by using tools like a WHOIS search.

If you are an individual running a test using a software client from a third party experimenter’s website

Measurement Lab also hosts measurement tests (also referred to as experiments) on behalf of experimenters who apply to do so, and whose applications are accepted by M-Lab’s Experiment Review Committee. While these experiments’ server side code runs on the M-Lab platform, the data collected are not necessarily stored or processed by M-Lab, and the software client you might use to conduct these third party tests is typically found on each experimenter’s website. M-Lab provides a link to each experimenter’s website, where their data is stored, and their privacy policies on our pages describing the tests that we host. Each experimenter is responsible for maintaining separate privacy policies with respect to the data they collect and your rights as data subjects.

If you are an experiment owner and/or developer

As you actively request us to contact you for more information about our project, M-Lab records your contact information and our partnership-related communications to be able to effectively communicate with you.

Based on the performance of a contract (GDPR Art. 6.1.b), we collect data from you in the form of name, contact data, including address and phone numbers as well as any personal data you choose to disclose over the course of our partnership. Name and contact data is filed in the contact list of our email client, GSuite, and other data is stored, unstructured, in the thread of our conversations. We do not disclose this data to our partners without your knowledge or permission. For further data please review our Memorandum of Understanding (MoU) with Experimenters.

Regardless of the location of persons with whom M-Lab has an above-mentioned partnership established through a jointly signed MoU, M-Lab maintains this data for up to 12 months after the end of our partnership (termination or non-renewal of the MoU), or as otherwise required to fulfill any applicable legal requirements. The data is processed for the performance of a contract (GDPR Art 6.1.b).

Your rights under the European Data Protection Directive (GDPR)

If the GDPR applies to you, you have the following rights which you can exercise directly with M-Lab, the data controller. You have the right to access your personal data by requesting that we provide you with a copy of the data we hold about you. If you contact us by email, you should expect your data to be sent by email. If you would like it to be provided through another medium, please let us know. You have the right to rectification and the right to erasure. We will do so if no existing legal obligation applies or if your data is not used for the defense or exercise of legal claims. You have the right to request that your data be corrected or updated. You have the right to request that the processing of your data be restricted if you believe we have not lawfully collected it or are not lawfully processing it. You have the right to data portability, requesting that we provide you with a portable format of your data (PDF, TXT, CVS…, please enquire about a specific format). Should you wish your data to be ported onto a third party, we will provide you with your data in a portable file, provided this is technically feasible and you have been able to verify your identity and the data that belongs to you.

M-Lab does not submit your personal data to automated decision-making. Please note that the rights above may differ depending on your location, our ability to verify your identity, and any legal exceptions or obligations we may have.

If you are a website visitor, we use Google Analytics to collect information about your site visit. This data is stored on Google Cloud in the United States, and is only available to M-Lab in aggregate.

When you email us, we collect your name and email address using a Gsuite operated mail box. This data is collected on Art.6.1.b GDPR. for the performance of a contract or entering into one.

Regardless of whether or not a website visitor is a GDPR data subject, this data is retained for up to twelve months after the end of our relationship, or as otherwise required to fulfill any applicable legal requirements. If you would like to opt-out of tracking by Google Analytics, you may install the Google Analytics Opt-out Browser Add-on.

Transfers of personal data from the EU to our cloud storage

Google LLC is certified under the EU-US and Swiss Privacy Shield Frameworks and their certifications can be viewed on the Privacy Shield list. Google is committed to complying with the EU General Data Protection Regulation (GDPR) for G Suite and Google Cloud Platform services. You can find GDPR-updated Data Processing Amendment for G Suite and Data Processing and Security Terms for Google Cloud Platform here.

Availability of test data

Your test data is made public under GDPR Art.6.1.f legitimate interest. The data disclosed includes your IP address, date and time.

How to exercise your rights under the GDPR

For data processed in the scope of this policy where M-Lab assumes the role of data controller (GDPR Art. 4.7), please write to us at privacy@measurementlab.net or by post at Measurement Lab, 3439 SE Hawthorne Blvd. #247, Portland, Oregon 97214-5048; please explain which right you wish to exercise and in which capacity. For instance you may be a website visitor wishing to exercise your right to erasure.

Right to lodge a complaint

We encourage you to contact us at privacy@measurementlab.net if you have a privacy related concern. However, you have the right to lodge a complaint to a data protection authority of your choice if you suspect us of improperly processing your personal data. You may choose to do so with the data protection authority of the European member state you live or work in but are free to turn to a data protection authority of the member state of your choices. A complete list of data protection authorities and their contact details in the EU can be found on the website of the European data protection board.

We encourage you to contact us at privacy@measurementlab.net if you have a privacy related concern. However, you have the right to lodge a complaint to a data protection authority of your choice if you suspect us of improperly processing your personal data. You may choose to do so with the data protection authority of the European member state you live or work in but are free to turn to a data protection authority of the member state of your choices. A complete list of data protection authorities and their contact details in the EU can be found on the website of the European data protection board.

Compliance and Cooperation with Regulators

We regularly review this Privacy Policy and make sure that we process the data we collect in compliance with it. Regardless of where your data is processed, we apply the same practices described in this Policy. When we receive formal written complaints, we respond by contacting the person who made the complaint. We may work with the appropriate regulatory authorities, including local data protection authorities, to resolve any complaints regarding the processing of data that we cannot resolve with you directly. You can contact your local data protection authority if you have concerns regarding your rights under local law.

Use of our services or website by children

Our services are not intended for anyone under the age of 16 years. If you are younger than 16, you may not use the website or platform.

Our website and privacy policy may contain links to the websites of third-party, non-Measurement Lab organizations. M-Lab is not responsible for the privacy practices or the content of websites or services other than M-Lab. Therefore, we recommend that you carefully read the privacy statements of such foreign sites.

Changes to this Privacy Policy

We may modify this privacy policy at any time to comply with legal requirements as well as developments within our organization. When we do, we will revise the date and version at the top of this page. Each visit or interaction with our services will be subject to the new privacy policy. We will record past versions of this policy through an archive on this page. We will also notify users subscribed to the M-Lab Discuss list and/or future M-Lab community forums of changes to this policy, if required by applicable legal obligations. By using our Services, you acknowledge and agree that it is your responsibility to stay informed about our policies and modifications made to it.

Contact Us

If you have any questions, comments, or requests regarding M-Lab’s Privacy Policy, please contact us at privacy@measurementlab.net.

Back to Top