Coinbase Analytics tracking on SDK initialization without user consent (GDPR issue)

[TimDaub]

Issue

The Coinbase Wallet SDK sends analytics requests to cca-lite.coinbase.com on connector initialization, before users interact with the wallet connection UI.

Tracking Observed

• Coinbase Analytics: cca-lite.coinbase.com/amp
• Coinbase Metrics: cca-lite.coinbase.com/metrics
• This happens before any user clicks "Connect Wallet" or chooses Coinbase Wallet

Note: Tracking after user selects Coinbase Wallet would be acceptable, but tracking before any user interaction violates GDPR consent requirements.

Problem

• GDPR requires consent before tracking
• Users are tracked even if they never select Coinbase Wallet
• Tracking occurs just from having Coinbase Wallet as an available option
• No documented way to disable analytics

Request

1. Defer analytics until user actually selects Coinbase Wallet
2. Add option to disable analytics tracking
3. Document the analytics integration and data collection

[fan-zhang-sv]

Hi thank you for reporting this

We actually introduced telemetry in Coinbase Wallet SDK's successor, Base Account SDK, and this repo/SDK has been deprecated and stable build of this old SDK does not have telemetry built in.

saw your thread here. I wonder if this behaviour is introduced by Rainbowkit init'ing wallet provider before wallet selection.

we do have a way to turn off telemetry here. appreciate the feedback, let us know if the issue persists