Trusted by Millions, Monetized in Secret: The Mainstream Software Quietly Selling Your Behavior
There is a reasonable assumption embedded in the way most people relate to paid software: that the transaction ends at the point of purchase. You pay for a license; the company provides a product; the exchange is complete. That assumption is increasingly disconnected from how software companies actually generate revenue in 2024. Across productivity suites, media players, PDF tools, and entertainment platforms, behavioral data collection has become a standard secondary revenue stream — one that continues regardless of whether a user paid for the product or acquired it for free.
This audit examines a selection of widely used mainstream applications, documents their data collection and monetization practices with reference to their own published policies, and identifies privacy-respecting alternatives in each category. The goal is not to alarm but to inform: users who understand what their software is doing are positioned to make deliberate choices about what they are willing to accept.
Productivity and Office Software
Microsoft 365
Microsoft 365 — used by an estimated 345 million paid seats globally — includes a data collection layer that extends well beyond the document content users create. Microsoft's own documentation acknowledges the collection of "diagnostic data" that includes feature usage patterns, performance metrics, and in certain configurations, content-level signals used to power AI features.
The Connected Experiences framework within Microsoft 365 enables cloud-based features by transmitting document content to Microsoft servers for processing. This includes features like Editor (grammar checking), Designer (layout suggestions), and the Copilot AI assistant. Each of these transmits portions of document content to Microsoft infrastructure. Users who work with confidential materials — legal documents, financial records, medical information — may not be aware that these transmissions occur by default.
To reduce exposure: navigate to File → Options → Trust Center → Trust Center Settings → Privacy Options and disable optional connected experiences. In organizational deployments, administrators can enforce more restrictive telemetry policies through Group Policy.
Privacy-respecting alternative: LibreOffice operates entirely offline with no telemetry by default. For cloud collaboration, Cryptpad provides end-to-end encrypted document editing.
Grammarly
Grammarly's browser extension and desktop application operate by intercepting text as it is typed across virtually every application and website on the user's machine. This is architecturally necessary for its functionality — it cannot suggest corrections to text it cannot read. However, the scope of that access means Grammarly's software has visibility into passwords entered in browser fields (before masking occurs), private messages, confidential work documents, and any other text input the user generates.
Grammarly's privacy policy states that it does not sell personal information as defined under the California Consumer Privacy Act. However, it does share data with a list of third-party service providers and uses aggregated, de-identified data for product development. The concern is less about deliberate misuse and more about the attack surface: an application with keystroke-level access to all text input represents a high-value target for adversarial actors, and a single breach would expose an extraordinarily sensitive data set.
Privacy-respecting alternative: LanguageTool offers a self-hosted option that processes text locally without transmitting it to external servers.
PDF and Document Tools
Adobe Acrobat Reader
Adobe Acrobat Reader, the default PDF viewer for a significant portion of American users, collects usage telemetry that includes which features are used, document interaction patterns, and in some configurations, information about the documents being viewed. Adobe's privacy policy permits the use of this data to "personalize" the user experience — language that typically signals behavioral advertising integration.
Adobe's broader ecosystem, including Creative Cloud, shares data across products and with Adobe's advertising technology partners. Users who have not explicitly opted out of Adobe's personalization framework may find their document interaction behavior contributing to advertising profiles they are unaware of.
Privacy-respecting alternative: Sumatra PDF (Windows) is a lightweight, open-source PDF viewer with no telemetry, no cloud connectivity, and no account requirement.
Media and Entertainment Software
Spotify
Spotify's data collection practices are among the most extensive in the consumer software category. The platform collects listening history, search queries, playlist contents, podcast consumption, and — on mobile — device sensor data including accelerometer readings that Spotify has used to infer user activity context. Spotify's privacy policy explicitly states that it shares data with advertising partners and uses listening behavior to construct interest-based profiles.
The free tier is explicitly ad-supported and data-monetized; this is disclosed and expected. Less commonly understood is that Spotify Premium subscribers are also subject to behavioral data collection and profiling, though they receive fewer targeted advertisements within the application itself. The data collection does not cease with a paid subscription.
Privacy-respecting alternative: Jellyfin is an open-source, self-hosted media server that supports music libraries with no external data transmission. For streaming, Bandcamp collects significantly less behavioral data and does not operate an advertising business.
Roku and Smart TV Platforms
While not software in the traditional desktop sense, Roku's operating system — present on tens of millions of devices and licensed television sets across the United States — operates one of the most aggressive automatic content recognition (ACR) systems in consumer electronics. ACR technology captures screenshots of whatever is displayed on screen at regular intervals and transmits those captures to Roku's servers for identification, enabling the platform to build a detailed record of viewing behavior across all input sources, including cable boxes, gaming consoles, and external media players connected via HDMI.
Roku's advertising business generated over $800 million in revenue in 2023, the substantial majority of which derives from targeted advertising enabled by this behavioral data. The ACR system is enabled by default and disclosed in Roku's terms of service under the label "Limit Ad Tracking."
To disable ACR on Roku: navigate to Settings → Privacy → Smart TV Experience and uncheck "Use Info from TV Inputs." Additionally, disable Settings → Privacy → Advertising → Limit Ad Tracking.
Privacy-respecting alternative: A dedicated media player running Kodi or Plex on hardware you control eliminates platform-level behavioral surveillance entirely.
Utility and System Software
CCleaner
CCleaner, once a trusted name in Windows system maintenance, was acquired by Avast in 2017. Following the acquisition, the application's data collection practices expanded significantly. A 2019 investigation revealed that CCleaner was transmitting detailed system information — including installed software lists, hardware configurations, and usage patterns — to Avast servers, where the data was sold to third parties through a subsidiary called Jumpshot. Avast subsequently shut down Jumpshot following the public disclosure, but the episode fundamentally altered the trust profile of the product.
The current version of CCleaner, now owned by Gen Digital (which also owns Norton and Avast), continues to collect telemetry under its updated privacy policy. Users who installed CCleaner years ago based on its historical reputation should evaluate whether that reputation remains warranted under its current ownership.
Privacy-respecting alternative: BleachBit is an open-source system cleaner with no telemetry and no commercial data collection.
Reading the Fine Print: A Practical Framework
The common thread across these applications is not malice but incentive structure. Companies that build free or freemium products require revenue. Behavioral data is valuable. The result is a predictable pattern: collect broadly, disclose minimally in legal language, and monetize persistently.
Users who want to evaluate any software's data practices before installation should look for three specific items in the privacy policy: whether the company sells or shares data with third parties for advertising purposes, whether the policy covers data collected through the application itself versus only data voluntarily submitted, and whether an opt-out mechanism exists and what it actually covers.
The alternatives listed in this audit are not necessarily superior in every functional dimension. They represent a trade-off: reduced features or convenience in exchange for a business model that does not require treating your behavior as a product. For users who handle sensitive personal or professional information, that trade-off is frequently worth making.