"Minimal data" would be my IP address, as that's necessary in order for traffic to be exchanged.

Everything else should only be collected with my informed consent. If I've consented, then whatever I've consented to is acceptable.

There is absolutely a gray area, though, where data collection may be unobjectionable. The reason I consider it a "gray area" is because it requires trusting whoever is collecting the data, and history has very clearly shown that trust is misplaced. I'm talking about things like: just counting, in the aggregate, how many times users have clicked a button is OK, but recording entire sessions is not (even if that recording is "anonymized"). But as an end user, it's impossible for me to tell who is being well-behaved and who isn't, so I have to assume that everyone is ill-behaved.