[jsf01]

Even the FTC struggles to define spyware. But I think you’re right that a disagreement on the definition is at the heart of all of this. I wouldn’t be so overconfident in asserting that spyware is defined in your particular way here, though. There isn’t exactly a consensus! VSCode is certainly not to be lumped in with password stealing keyloggers, but because they continue collecting telemetry data even after you explicitly disable it, VSCode does fall under the “collecting data without a user’s knowledge” category of spyware.

[jrm4]

I'm very comfortable calling ALL OF IT spyware until something like the GDPR cookie thing exists for it. (or they voluntarily make such a statement BEFORE you use it)