Yep. Your problem is you're hiding all the inconvenient logging and generation of metadata propagating knowledge of my communication with your website beyond the scope of what was intended every time you propagate out metrics logs, or transaction data out to other third parties.

If you stop at "oh, an HTTP session happened", you're being a disingenuous maker and perpetuate of strawmen. It's almost always what happens with data by actors you invite into that "seemingly private HTTPS transaction" that violate the simplestsocial precept of the technical exchange.

Things branch off from there. If you can't see that as a fundamental breach of privacy and professional discretion, then again, it's likely you have a vested interest in not seeing it. It's damned obvious to anyone who doesn't.

> defining privacy in a contextually relevant and concise manner is hard.

How about asking the users what privacy means to them.

Why is the concept of "consent" so hard to user-hostile devs?

Why would Google be interested in getting consent for something they can force without you being able to complain about it? That makes no business sense, and the only thing that makes Google change things is if there are dollars at stake.

And then only dollar amounts that move the needle (and if your choice negatively impacts the business by only a million dollars ayear, that's an irrelevant difference for Google. They literally don't care, because a million is peanuts, and does not move the needle)