> Much of this would be semi-public anyway, they could be analysing HTTPS traffic to find most if not all of these conclusions. I'm not sure I understand this

> Much of this would be semi-public anyway, they could be analysing HTTPS traffic to find most if not all of these conclusions. I'm not sure I understand this sentence. What about analyzing HTTPS traffic is analogous to analyzing "semi-public" data? By design and convention, HTTPS traffic is considered private data. Portions are by technical necessity still public, such as the hostname and IP addresses. In order to produce these findings, private data (which is certainly not public or semi-public) such as full URLs and user-agents needed to be analyzed.