Should this really be serialising the user data without them explicitly knowing about, or requesting, it?