A big part of the decision is opt-out vs. opt-in, and how it would even be possible to make opt-in return meaningful results in a library. Also, one of the main problems was managing the expectations of the users of the library, many of whom would only install it through a packaging system which provides little means of documenting that tracking is included and enabled by default.
Here is the initial thread sharing a user's surprise:
They're not the only ones to do this. Vuforia is worse, it's free, which is tempting, but then Section 8 (i) of the license agreement[0] states:
"each end user consents to the collection, storage, and use by QCE and its affiliates and service providers of Statistics from the Software and the transfer of Statistics between QCE and its affiliates and service providers (which may be in the United States or in other countries), in each case for the purposes of (a) facilitating the provision of new products, updates, enhancements and other services, (b) improving the Software, and other products, services and technologies, and (c) providing new products, services or technologies to You and customers of QCE and its affiliates;"
To be fair, they're giving away a great SDK for free that they've put a lot of effort into, so they can demand what they like from the license. Google can too - you don't have to use the free stuff they're giving away.
I think as long as you tell the user then you're ok. If the user wanted to find out what information the Vuforia guys have collected they would have to ask them, pay the £10 (in the UK), and then it would be up to the Vuforia people.
I use to be the "Data Protection Expert" at a firm a few years ago, but really all that happened was they sent me on a course and I read the rules. Never had to actually deal with a case.
