> I'm not talking about that. The user is making a permanent copy on disk when downloading. The copy was made by the party that distributed it to the user, whi

> I'm not talking about that. The user is making a permanent copy on disk when downloading. The copy was made by the party that distributed it to the user, which was implicitly authorized by the fact that they sold it to the user. > IIUC this has been ruled by various courts to require a copyright holder's permission. This is wrong on several levels. First, no copy is being made by the user. Second, copyright only applies when copies are made and distributed. Third, no court has ruled that copyright even applies to the user when a copy sold by the copyright holder. Please read about basic copyright law if you want to argue on this topic. > Some countries I can only speak about US law. > the apparent illegality of downloading Downloading is never a violation of copyright. Clearly you have never read anything about copyright and it's history. > ordinary users often do create copies That would be a violation of copyright, but recent rulings have ruled that transient copies that are a temporary and part of the normal technical process of using the software (such as RAM copies) are not a "copy" as far as copyright is concerned. > Wikipedia logs edits, including IPs for anonymous ones. Are you being obtuse on purpose? There is an obvious difference between voluntary edits made by the user, who is necessarily aware that Wikipedia will record when and what you edit as part of the editing process, and unknown "telemetry" or "analytics" that happen invisible to the user and may apply to data that was not directed at Facebook/etc. Obviously Wikipedia will log your edit; that's the intended result. Facebook reading messages you sent to your friend is spying that requires informed consent. > We don't have good estimates of the future risk of sharing data now We know they can be incredibly damaging right now, and I don't see this risk getting any smaller in the future. It will only get easier to de-anonymize data. > the correct action wasn't necessarily not to sell or buy any electrical products Of course. The moral action would have been to sell products that err on the side of caution, even if that makes them more expensive or less usable. To do otherwise is to willingly risk your customer's safety. How about this: if you are so sure the risk is acceptable, you should indemnify your users against any future problems that result from data collection and sharing. If you think this is unreasonable, then you're admitting the risk is too large and you simply want the user to bear that risk. On the the other hand, if you think this risk is fine, then you shouldn't have any problem accepting liability.