> how do you distinguish 'telemetry' from 'surveillance'?

Granularity. Telemetry data can be privacy-respecting (e.g. anonymously aggregated) while still being useful.

E.g. "143 people flew from NYC to LA this month" vs. "John Smith flew from NYC to LA at 2:00 pm on Tuesday."

An example, measuring traffic flow in a city.

You can do it with cameras and ID plate detection tools, which allows tracking where anyone is at any time.

You can also put magnetic loops into the roads, which just tells you how many drive over a certain area of the road, without any individualized tracking.

Good telemetry is like the magnetic loops. But nowadays very few implementations are that privacy respecting

Better surveillance: put RFID readers in the road that track the RFID tags in the tires. Then ping that against the database of who bought what tires. People won't known what hit them.

That is true for people with the same level of access as you. The 3 letter agencies have access to much wider array of data and yours can and will be used to track people of interest and those who they deem problematic.

Do you want to be surveilled?

We promise it's anonymized.

Would you mind setting up a 24/7 stream of your bedroom? I don't know you, so technically it's anonymized.

>how do you distinguish 'telemetry' from 'surveillance'?

For starters, consent. Telemetry generally supposes that the user opts into, either directly or by accepting the terms of using a service, and is free to walk away.

I find the increasing usage of the word surveillance completely silly and ideological. If the NSA vacuums data from some underwater cable that's surveillance, when I exchange information, aware of what's being handed over in exchange for some service, that's a trade.

How aware can you be though? Windows has dozens of different endpoints [1] that collect thousands of data points [2], and I presume that can change at any time with an update.

Who has the time to read (let alone "become aware") of the full scope of that?

[1] https://docs.microsoft.com/en-us/windows/privacy/windows-11-... [2] https://docs.microsoft.com/en-us/windows/privacy/required-wi...

Here in the EU at least Windows walks you through privacy and telemetry settings on the first start and you get a very direct overview of what's being collected and knobs to turn it off, courtesy of the GDPR I think. I don't think changing data collection automatically is legal either.

I'm all for informed consent, create laws to give users transparency and control over their data. But if users have that and they still decide that exchanging info for better services is worth it, calling it surveillance is I think not appropriate.

Case in point, Vscode. I'll gladly give them telemetry access for getting a better editor.

I presume you mean the OOBE (at Windows install) where you get to choose between "Required" and "Optional" telemetry; we have that in the US as well. BTW, the [2] link includes only the data set for "Required" telemetry which you have no way of disabling (unless you do DNS / IP blocking or manually disable / delete services and scheduled tasks).

> I find the increasing usage of the word surveillance completely silly and ideological.

That's nice. I find downplaying the reality of surveillance to acclimate people to even more of it very dangerous and ideological.

if it's automatic, doesn't that make it "opt out", not "opt in"?

> Here it is in a nutshell: In the general case, how do you distinguish 'telemetry' from 'surveillance'?

By never sending PII to your telemetry system. Or if you must use PII (you don't need to) then you lock it away with proper access controls.

You shouldn't have had to say it, but thank you.