Constraints on reporting information

Hi web perf folks,

In https://github.com/w3ctag/privacy-principles/pull/221, we're discussing
how UAs can decide to send ancillary data like performance reports. UAs
could always ask the user for permission, but to avoid prompt fatigue, I
believe this group thinks (and I'd agree) that some reports are ok to send
by default.

How do y'all think the web platform should make decisions about which ones
are ok?

For example, we let applications record lots of information about the times
it takes them to do things, but we're considering hiding certain changes in
the user's network <https://w3c.github.io/reporting/#network-leakage>.

Is the decision based on just the WG's and horizontal reviewers' feelings
about each individual API, or are there some systematic constraints we can
apply?

Thanks,
Jeffrey