Drupal.org policies on module behaviour

From the Kaltura situation and other similar events ISTR, I would say our policy on that regard is not to disallow reporting anything, but making it strictly explicit to sites deploying the modules.

We may even require opt-in instead of opt-out, although the situation may not be as clear cut: any module deployed on a site in the default configuration has update module reporting it to d.o. itself, and any module with a custom update url has deployment stats being reported to its update server.

The situation to be addressed is likely to be more complex than we might wish:

• reporting on module installs, as provided by core update and its previous update_status incarnation. Likely to be acceptable as opt-out, as long as it only reports on installs and/or current deployed instances, typically for security purposes (updates) or decisions by the module authors regarding sites potentially affected by code changes
• reporting on site use, like number of forms being displayed over time, like spam control modules can do, or reporting on module use, like tracking visitors themselves, as provided by analytics modules. Some of these, like Google Analytics or Mollom, are by purpose reporting to third-party servers, and won't even be of any use without such reporting. So installing them can be seen as an "implicit" opt-in. But this raises the question of the level of information of site users where such a module is deployed. GA has provisions about this, like clear documentation and use of the global opt-out list, but other modules may not be so evolved. I'm not sure the spam control family of modules (Akismet and others) are as protective of privacy, actually. I suspect this will always be a grey area at some level: any such service deployed in the cloud will be more or less directly trackable in the cloud hosting service bandwidth usage reports, although no private information about visitors will be available. Do we have a problem with that ?
• reporting on site visitors where this is not the documented purpose of the module, as happened (among other problems) in the Kaltura issue mentioned by mlncn. We have, I hope, a consensus that this should at a minimum be an opt-in feature, and never an opt-out or, worse, something hidden in the code as in the issue already mentioned.

And, of course, as someone said in the already mentioned issue, trying to define clear cut rules will have "rocket scientist" interpreting rules to their advantage. Potter Stewart judgments, it seems.