Do not send usage data to Canonical (popularity-contest, ubuntu-report, ubuntu-insights)

Description

Three Ubuntu tools can send information about the system to Canonical:

• popularity-contest sends, once a week, the list of installed packages and when they were last used, when PARTICIPATE="yes" is set in /etc/popularity-contest.conf. It is installed by default on 20.04, through the ubuntu-standard metapackage;
• ubuntu-report (up to 24.04) sends the hardware, release, locale and screen details collected at the first login of Ubuntu Desktop, when the user accepts;
• ubuntu-insights (from 26.04) replaces it: it collects hardware and usage reports every week and uploads them when the user consented; when the user refused, it still sends an opt-out notice.

The control requires PARTICIPATE="no" when popularity-contest is installed, and ubuntu-report and ubuntu-insights to be absent.

popularity-contest is kept installed on 20.04 because removing it also removes the ubuntu-standard metapackage; with PARTICIPATE="no" its weekly job sends nothing. The fix also sets the debconf answer to false, so that a reconfiguration of the package keeps the setting. ubuntu-insights system-opt-out stops collection for every user without removing the package, but leaves the decision on each machine: removal is easier to audit. Crash reports (apport, whoopsie) are handled by CB-UBU-BOOT-015, and the network message of the day by CB-UBU-AUTH-030.

Rationale

The package list describes the software stack and its versions, which is useful to an attacker and is part of the organization's information system description. The hardware and usage reports go to a third party without a contract or an assessment under the GDPR. The decision belongs to the organization, not to whoever answers the first-login question.

Impact

Canonical no longer receives statistics from the system; nothing changes for its users. Removing ubuntu-report and ubuntu-insights does not remove the desktop metapackages, which only recommend them.

Setting

Audit

1. If popularity-contest is installed (dpkg-query -W popularity-contest), grep PARTICIPATE /etc/popularity-contest.conf must show PARTICIPATE="no".
2. dpkg-query -W -f='${Status}\n' ubuntu-report ubuntu-insights must not print install ok installed.

Automated: every check must pass. Scanners report each check by its id.

popcon

popularity-contest is absent or set to PARTICIPATE="no".

script: |
  if ! dpkg-query -W -f='${Status}' popularity-contest 2>/dev/null | grep -q 'ok installed'; then
    echo "popularity-contest not installed"
    exit 0
  fi
  v=$(sed -n 's/^[[:space:]]*PARTICIPATE[[:space:]]*=[[:space:]]*//p' /etc/popularity-contest.conf 2>/dev/null | tail -n 1 | tr -d "\"'")
  echo "PARTICIPATE=${v:-<not set>}"
  [ "$v" = no ]

ubuntu-report

Ubuntu hardware and usage report tool.

name: ubuntu-report
state: absent

ubuntu-insights

Ubuntu Insights report tool.

name: ubuntu-insights
state: absent

Remediation

1. popularity-contest: set PARTICIPATE="no" in /etc/popularity-contest.conf, or run dpkg-reconfigure popularity-contest and answer no.
2. Run apt purge ubuntu-report ubuntu-insights.

Rollback

Run dpkg-reconfigure popularity-contest and answer yes, or reinstall ubuntu-report or ubuntu-insights with apt install.

popcon

f=/etc/popularity-contest.conf
dpkg-query -W -f='${Status}' popularity-contest 2>/dev/null | grep -q 'ok installed' || exit 0
grep -qx 'PARTICIPATE="no"' "$f" 2>/dev/null && exit 0
echo 'popularity-contest popularity-contest/participate boolean false' | debconf-set-selections
cb_backup "$f"
if grep -q '^[[:space:]]*PARTICIPATE[[:space:]]*=' "$f" 2>/dev/null; then
  sed -i 's/^[[:space:]]*PARTICIPATE[[:space:]]*=.*/PARTICIPATE="no"/' "$f"
else
  printf 'PARTICIPATE="no"\n' >>"$f"
fi

ubuntu-report

Generated from check ubuntu-report: the engine writes the fix for every output, it sets the expected value and the check runs again after.

ubuntu-insights

Generated from check ubuntu-insights: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• popularity-contest(8), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• Ubuntu popularity contest Canonical, vendor-doc, accessed 2026-10-19
• ubuntu-report source repository Canonical, tool, accessed 2026-10-19
• ubuntu-insights source repository Canonical, tool, accessed 2026-10-19
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R58) ANSSI, guide, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-UBU-BOOT-015 Disable automatic crash reporting (apport, whoopsie)

People and lifecycle