[danpalmer]

Other replies have made good points I agree with, but another way of looking at this is what "spying on me" means.

For example, is bookmark sync "spying"? I would say no, but many would say yes simply because that sync goes through someone else's machine. If the browser vendor uses aggregated domain popularity across bookmarks to inform their browser testing, is that now spying on me? Maybe, but the term "spying" has significant negative connotations that still don't feel justified to me. What if the browser vendor uses those bookmarks to target personalised information about browser feature improvements, is that now spying? I might find that a bit weird, but there's still an arguable user benefit there, and if that happened on device it's not really any different to most offline data analysis.

"Spying" really is a wide spectrum, from things that greatly benefit users with no privacy downside, to things that greatly benefit service providers with no user benefit. It's a nuance discussion that is worth having – just because something syncs to a server doesn't mean it's not worth doing, just because something is end to end encrypted doesn't mean it's not spying on you.

[oakpond]

I propose focusing on the worst part: information collection on a massive scale. Even if it is not used right now by a spy. They can use what is collected at this moment against you at any point in the future.

[danpalmer]

This is fair, but hard to define. If you necessarily store data as part of providing a service, but don't use that data for (example) ad targeting, is that a problem? That's a service that cannot exist without data collection (examples being cloud storage), and a service that is valuable to users. Should we avoid services because of what they could do in the future?

Things like the DMA are addressing this well I think. The DMA aims to prevent sharing of data for things the user did not opt in to, that are outside of the product remit. So a hypothetical cloud storage provider could not use that data for ad targeting without getting an opt in from the user, but the user can still use the storage service.