i agree, this goes against GDPR.7.4 https://gdpr.eu/article-7-how-to-get-consent-to-collect-personal-data/ https://gdpr.eu/article-7-how-to-get-consent-to-colle

i agree, this goes against GDPR.7.4 https://gdpr.eu/article-7-how-to-get-consent-to-collect-personal-data/ https://gdpr.eu/article-7-how-to-get-consent-to-collect-pers... see especially the recital https://gdpr.eu/Recital-43-Freely-given-consent/ https://gdpr.eu/Recital-43-Freely-given-consent/ >> Consent is presumed not to be freely given ... if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. Also note GDPR.7.3 >> The data subject shall have the right to withdraw his or her consent at any time. [...] It shall be as easy to withdraw as to give consent. If you can't withdraw the consent, it is not consent. So this EULA is at least bad form. (from a european perspective) For the far more interesting question if it is legal see https://gdpr.eu/article-6-how-to-process-personal-data-legally/ https://gdpr.eu/article-6-how-to-process-personal-data-legal... If it is not consent then it falls under GDPR.6.1.f "legitimate interests" which is far worse to discuss, as it puts your fundamental right to not have the usage of a product you bought be surveilled by the manufacturer - against their business interest to get telemetry. It would be far easier for everyone if they would just make it a separate checkbox you can toggle on and off (actual consent). However note that you do not have to use the product, you can refund it, so arguing this is a massive violation of human rights isn't going to fly. Should you bring this case to your local data protection agency, they will first try to reach an agreement between you and the company that fulfills both sides interests. Note: no matter what the contract says your local agency is there to supports you as a first responder. The company will likely have to show some improvement, at best an actual consent checkbox, at least a change of the bad form. If you actually go there you should wiretap the device and bring evidences what data the company collects. If it turns out to be a lot more than reasonable (id of the camera, time, gps locations, frames of the content) and the company is not cooperating, then the claws come out and its fining time. However if it turns out to be harmless, pseudonymous and processed to high standards, then the agency will ask you if you can accept that and saying no will turn into a lot of work in front of a court. Disclaimer: i am not a layer and this is just laymen talk about my opinion about how things are.