> If what they want isn’t in your app, they can’t do it and it won’t show up in your data.
Excellent point.
> but if it’s not entirely opt-in, I think it is effectively spying no matter what you’re collecting, varying only along a dimension of invasiveness.
Every web page visit is logged on the http server, and that's been the default since the mid 1990's. Is that spying?
In principle, yes, I believe it is a form of spying. Not particularly invasive nor harmful, but spying nonetheless.
Logging every page visited is not a technical requirement of serving the requested resource.