> If what they want isn’t in your app, they can’t do it and it won’t show up in your data.

Excellent point.

> but if it’s not entirely opt-in, I think it is effectively spying no matter what you’re collecting, varying only along a dimension of invasiveness.

Every web page visit is logged on the http server, and that's been the default since the mid 1990's. Is that spying?

In principle, yes, I believe it is a form of spying. Not particularly invasive nor harmful, but spying nonetheless.

Logging every page visited is not a technical requirement of serving the requested resource.