Anyway, 6K for harming children at that scale remains ridiculous.

Here you told them to unpack the food and repack it (TLS termination), filtering order (WAF), reheating pre-made food (cache) and they offer service to even prepare food or part of the food (edge compute). When your food is not available they will serve their own (error pages), with their brand visible. At that level of service, it's not so surprising to have extra stuff included.

If you are vegan and care about your customers (conservative on data collection and JS), maybe you should use a vegan architecture and not give your last-mile to the cheapest (free-tier) all-purpose repacking kitchen and delivery service.

When selecting free tier of such commercial MITM, opt-in RUM data collection is really far from the top ethical concern. I'm not saying it's a good thing and I'm not deploying their solutions to my websites.

As a website owner, you are responsible towards your users for data collection (your architectural choices, your responsibility). This was my concern on GDPR.

Sibling comment says data collection is disabled in EU.

GDPR is about legality and covers the LinkedIn case you mention.

Collecting RUM and giving you the opportunity to turn it off is not that bad for a free service.

Makes me wonder if their stuff is GDPR-compliant without consent. If not, then ok, maybe that's bad to turn it on by default.

When it's free you know you are being used, collecting data is the game.

If someone is mad, maybe they should pay or use a different architecture.

We'll now see if "thousands of partners" is considered as a good match for "informed consent". Doesn't mean there is a need for review, unless the legislator is not happy with the interpretation that will be provided.