Not sure about the US but in Europe and UK, GDPR would not permit them to collect anything that is not strictly needed without explicit consent. The Data Minim

Not sure about the US but in Europe and UK, GDPR would not permit them to collect anything that is not strictly needed without explicit consent. The Data Minimisation principle says you should only collect what you need. They can soft-opt you in to certain things if you have a business relationship (news letter) but this should be opt-outable, I think even at purchase time. It would also not permit the extension of data collection without consent (or another acceptable basis, but that would be unlikely). In the case of a service online, I guess you could potentially say if you don't like it, don't use the service but with hardware, I don't think this would fly.