Background: Governments worldwide are considering data privacy regulations. These laws, e.g. the European Union's General Data Protection Regulation (GDPR), require software developers to meet privacy-related requirements when interacting with users' data. Prior research describes the impact of such laws on software development, but only for commercial software. Open-source software is commonly integrated into regulated software, and thus must be engineered or adapted for compliance. We do not know how such laws impact open-source software development. Aims: To understand how data privacy laws affect open-source software development. We studied the European Union's GDPR, the most prominent such law. We investigated how GDPR compliance activities influence OSS developer activity (RQ1), how OSS developers perceive fulfilling GDPR requirements (RQ2), the most challenging GDPR requirements to implement (RQ3), and how OSS developers assess GDPR compliance (RQ4). Method: We distributed an online survey to explore perceptions of GDPR implementations from open-source developers (N=56). We further conducted a repository mining study to analyze development metrics on pull requests (N=31462) submitted to open-source GitHub repositories. Results: GDPR policies complicate open-source development processes and introduce challenges for developers, primarily regarding the management of users' data, implementation costs and time, and assessments of compliance. Moreover, we observed negative perceptions of GDPR from open-source developers and significant increases in development activity, in particular metrics related to coding and reviewing activity, on GitHub pull requests related to GDPR compliance. Conclusions: Our findings motivate policy-related resources and automated tools to support data privacy regulation implementation and compliance efforts in open-source software.

翻译：背景：世界各国政府正在考虑制定数据隐私法规。这些法律（例如欧盟的《通用数据保护条例》（GDPR））要求软件开发者在处理用户数据时满足隐私相关要求。先前的研究描述了此类法律对软件开发的影响，但仅针对商业软件。开源软件通常被集成到受监管的软件中，因此必须为合规性进行工程化设计或调整。我们尚不清楚此类法律如何影响开源软件开发。目的：了解数据隐私法律如何影响开源软件开发。我们研究了欧盟的GDPR，这是此类法律中最具代表性的法规。我们调查了GDPR合规活动如何影响OSS开发者活动（RQ1）、OSS开发者如何看待履行GDPR要求（RQ2）、最难实施的GDPR要求是什么（RQ3）以及OSS开发者如何评估GDPR合规性（RQ4）。方法：我们开展了一项在线调查，以探索开源开发者（N=56）对GDPR实施的看法。此外，我们进行了一项仓库挖掘研究，分析了提交至GitHub开源仓库的拉取请求（N=31462）的开发指标。结果：GDPR政策使开源开发流程复杂化，并为开发者带来了挑战，主要涉及用户数据管理、实施成本与时间以及合规性评估。此外，我们观察到开源开发者对GDPR持有负面看法，并且与GDPR合规相关的GitHub拉取请求上的开发活动（特别是与编码和审查活动相关的指标）显著增加。结论：我们的研究结果呼吁提供政策相关资源和自动化工具，以支持开源软件中数据隐私法规的实施与合规工作。