I do not think that privacy is restricted to PII. For me, computer privacy is as simple as 'any information about what i do with computer that need not leak outside should not leak outside'.

PII leakages are just considered more severe than general information leakages, so there is a legislation to handle them.

So checking for updates without sending any identifier counts, since it transmits the fact you did in fact run the application, and it's not strictly necessary.

I can see the point but it seems hard to draw the line for every single feature at the precise point of "does a network connection". For some programs there is quite a grayscale of what's "necessary" (i.e. needed) and what isn't.

I agree that in some cases there is a grayscale because what is an important behavior for some users may be unnecessary for others. For example, i could accept that incremental search using Google when text is entered to address bar in a browser could be considered both useful feature and privacy violation depends on user expectations.

But i also think there are some clear lines, like if a tool is not expected to use network at all, it should not use it. If a tool is expected to communicate just with explicitly specified hosts, it should not communicate with third-parties, ...

Checking for updates leaks your IP, which is PII.

yes, it leaks the information that you use the application (at all), at what times and so on, at a (potentially) individual level. But I'm not sure what the remedy is for some applications auto updates might be unexpected or even unwanted, but for other applications it would feel pretty bad to not have them and have them enabled by default. That's the user's expectation - not the expectation of privacy for their IP. I think user expectations should be in focus, but it's not always easy to guess. Saying "put the lid on everything and let the user actively enable anything, check for updates etc" also isn't very user friendly.

I think software updating itself is sort of a windows mentality.

Most other operating systems (linux, macos, ios, etc) update through an os-wide mechanism.

Debian already has apt and that downloads a list of package names and versions from each repo and what is on the system is generally hidden. If the user asks to install a package, then the user has opted-in to download and install that package/dependencies. Also the packages can come from a variety of caches and mirrors.

> I think software updating itself is sort of a windows mentality.

Yes it's definitely a mentality of "the apps are separate from the OS" at least, which is basically every OS except Linux/Unixes with central package managers. Even on a Debian or Ubuntu system, I'd be using dozens of non-packaged applications though (Be they locally compiled from github, or flatpacks or whatever).

> Saying that checking for updates is a privacy violation just means that everything is lumped together

Your IP address is considered PII. Hell with a timestamp you can easily track the behavior of people. When do they work, when are they asleep, which holidays do they observe, when are they on vacation, ... . You can get really creepy with a tiny amount of actual information and some statistical analysis.