gnome-initial-setup will default to displaying the toggle as enabled, even though the underlying setting will initially be disabled. (The underlying setting will not actually be enabled until the user finishes the privacy page, to ensure users have the opportunity to disable the setting before any data is uploaded.)

I see what they’re saying here and how they’re trying to give users options for users to opt-out before “accidentally” sharing data.

We are not interested in opt-in metrics. To make this a little more confusing, metrics collection is actually separate from uploading. Collection is always initially enabled, while uploading is always initially disabled. The graphical toggle enables or disables both at the same time.

Given all this I have even lower confidence that the opt-out will be bug free, especially over time. If the settings are separate then why just one toggle? If it were separate, I might want to collect then inspect the data and maybe even choose to share (or use the data myself some other way).

Few users would opt in…

Well yes, if it’s all my way or the highway. I understand that this is a tough problem to solve and a tougher one to message correctly. Hopefully someone will figure it out one day.