The GDPR lists IP addresses as PII, and not to be all "your IP address is leaking" but in order to send the telemetry, your computer's IP (or that of your VPN) is being sent to Dropbox, potentially to be logged.
AFAIK, it's only an issue if it's actually logged. Also, pretty much all services need to know the IP address during a session. It's fine if it's only used for the purpose of providing the service and not logged.
That’s not a GDPR issue other than if stored. And remember this is an app that already must send requests to the same place in order to function at all.
Of course not. It might send your medical records too.
It will send the IP regardless of whether telemetry is enabled. But they do claim that no PII is stored for telemetry. Whenever the topic of Telemetry comes up I try to keep to the discussion about properly anonymous telemetry, simply because that’s where there is any discussion at all. If anyone transmit or stores anything they aren’t entitled to it’s obviously always wrong so that’s not an interesting discussion.
Dropbox of course already stores PII (your files) but that doesn’t mean they can do so for other info or other purposes.
Just because the DNS entry says telemetry in the name doesn't mean a thing. Just like if they'd called it medical-records-here.dropbox.com and were only sending telemetry to it.
Whenever the topic of telemetry comes up, I try and point out that just because someone says it's just telemetry, it doesn't mean a damn thing. If anyone thinks it's not interesting because they think things are obviously always wrong, I ask them: what does telemetry mean to you? What does it mean to the company?
Are you sure those two definitions are in 100% agreement?