In reply to Vova Feldman.

@Vova, no, I can not write my own analytics server as things like google search tools integration are not possible to be written with the API google offers, and I can not do a like button without letting FB track you, etc. This is something the US don't care about but the EU cares.

Even if it is a properly done opt-in (no info is gather on anything else, and no info is gathered unless enabled) it is a surprise to the user that just downloads a plugin from wp.org which doesn't specify it has any tracking code by a 3rd party service. This is potentially very annoying to the user as it will probably never be stated upfront.

There is also the security aspect. if you can give a list of sites on which the plugin is installed. All an attacker needs to do is write a subtle back door into a plugin and use your service to know which sites to attack. And then of course there are your own security practices, why should I trust your security.

There is really no need to be offended by my comment as all these points were raised when the repository was started against the idea of having an update service integrated into it. But the update service offered features which are obviously good to the user, while it doesn't seem lie you offer any such features.

Side Note: obviously every plugin can do its own usage tracking and I think some do (I think yoast and EDD) but it is very subtle and not disruptive to the user in anyway. I am sure users will be shocked when they will receive emails asking them why did they deactivate plugin Y.