> It's very common to log when a button is clicked. Which means we can already reconstruct a user's session because we know what coordinates buttons have. We mi

> It's very common to log when a button is clicked. Which means we can already reconstruct a user's session because we know what coordinates buttons have. We might miss out on the random movements and such, but that might not be a big deal if we also log the timestamp when a button was clicked. The point I was making above was that there's a difference between purely client-side events like mouse movements and keystrokes and server-side events like button clicks and page requests. This may be a trivial difference for most websites, but I have an expectation of privacy around client-side events. Collecting them without the user's consent violates that regardless of the technical mechanism of implementation of that collection. > Your car collects huge amounts of data about your driving habits. A Tesla, for example, might auto-report that data, but your "dumb" car also provides that data to an ODBII reader. In fact, that was the premise for those Progressive (I think) Car Insurance things they wanted you to plug into your car to "prove" you were a safe driver. Right, and the difference is that the data provided through the OBD port requires me to physically plug something in and upload it elsewhere. I have control over that data. This is different from these websites that are collecting data like my mouse movements and immediately sending it off without notification or consent.