You bought a Framework laptop because you believed in something. Repairability. Sustainability. A company that seemed to actually give a damn about you, the user, not just your wallet. And then they handed your data to third parties without asking, and when they got caught, their response was to scope down the access. Not stop it. Scope it down.
Read that again. The fix for unauthorized data sharing is… slightly less unauthorized data sharing.
The breach isn’t the scandal. The business model is the scandal.
Here’s what Framework actually said in their damage-control response: they’re “evaluating the breadth and depth of data shared with business intelligence platforms, and scoping down their access to only the columns required for analysis.”
Notice the language. “Evaluating.” “Scoping down.” “Only the columns required.” This is corporate speak for: we were feeding your data to analytics platforms for our own benefit, and now we’ll feed them slightly less of it.
A Reddit user nailed the response better than any tech journalist could: “Or you could just stop fucking sending my data to third parties when it’s for your own sole benefit rather than mine.”
That comment has more moral clarity than Framework’s entire PR statement. Because it cuts through the technical deflection and names the actual issue: consent.
Framework built its brand on the idea that you should own your hardware. Repair it. Upgrade it. Keep it. That’s a powerful narrative, and it earned them a fiercely loyal community. But ownership of hardware means nothing if the company behind it treats your data as its own property by default.
You can’t sell people empowerment with one hand and harvest their data with the other and call yourself ethical.
The framing matters here. Framework wants this to be a technical conversation about data scoping, access columns, and business intelligence integration. That’s a comfortable conversation for them. It has parameters. It has solutions. It has a roadmap. You can put it in a postmortem and check the box.
But what users experienced was betrayal. They trusted a brand that positioned itself as the anti-Apple, the anti-Dell, the anti-everything-that-treats-you-as-a-product. And that trust was violated not by a sophisticated attack, but by the company’s own default operating procedure.
This is the part nobody wants to hear: the breach didn’t create the problem. It exposed it.
Framework was already sharing user data with third-party business intelligence platforms. That was happening before the breach. The breach just made it visible. Which means the “fix” isn’t about preventing unauthorized sharing—it’s about preventing the next time you find out about it.
Damage control is not the same as accountability. Scoping down access is not the same as asking permission.
If Framework truly believed in the principles it markets, the response would be simple: we will not share your data with third parties without explicit, opt-in consent. Full stop. Not “we’ll scope down the columns.” Not “we’ll evaluate the breadth.” We won’t do it unless you tell us to.
That they couldn’t bring themselves to say that tells you everything about where their priorities actually sit.
The hardware is still good. The mission of repairability still matters. But let’s not pretend this is a minor PR stumble. This is a fundamental values test, and Framework answered it the same way every other tech company answers it: with technical mitigation instead of moral accountability.
If you own a Framework laptop, you should be asking them one question: why was my data being shared with third parties at all?
Not how much. Not which columns. Not what scope. Why.
A company that makes you the product while selling you empowerment isn’t disrupting the industry. It’s just wearing a better costume.
FAQ
Q: Isn't scoping down third-party access a reasonable step in the right direction?
A: It's a reasonable step if your goal is to reduce liability. It's not a reasonable step if your goal is to rebuild trust. The difference between scoping down and stopping entirely is the difference between "we'll take less of your data without asking" and "we'll ask before taking any." One is mitigation. The other is consent. Only one of them respects you.
Q: What should Framework actually do to fix this?
A: Default to zero third-party data sharing. Make any analytics sharing opt-in, explicit, and revocable. Publish exactly what data goes where, to whom, and why. If their business intelligence needs are so critical, they can build in-house analytics that don't require shipping user data to external platforms. Anything less is a compromise dressed up as a solution.
Q: Is this really that big a deal compared to what Apple or Google do with data?
A: Scale doesn't determine principle. The issue isn't whether Framework is worse than Google—it's that Framework positioned itself as the ethical alternative and then operated with the same default data-hoarding assumptions as everyone else. The betrayal isn't in the act. It's in the gap between what they promised and what they did.