That's not why people enter the race, in my experience. I remember years back talking to friends and people I knew who all said things like 'think of the data

That's not why people enter the race, in my experience. I remember years back talking to friends and people I knew who all said things like 'think of the data we're collecting' - nobody thought about asking the end user if they wanted that data collected. It's not about 'oh no, I have to spy on my users;' the users aren't considered at all. If they are, there are patterns built to prevent them noticing and limit liability. It's pretty vile. Ethically, you should only try collect the data you reasonably believe your users would be ok with you collecting if they knew as much as you did about what a bad actor could do with it, and you should ask them first.