“This data is sent without user consent, unencrypted, and even when using a Google-free Android distribution.”
A de-Googled Sony Xperia XA2 running /e/OS phoned izatcloud.net two seconds after joining WiFi. That domain belongs to Qualcomm, the requests go over plain HTTP, and Qualcomm’s own policy lists a unique ID, chipset serial number and the software on the device among what it collects. Qualcomm only added IP addresses and a 90-day retention to its privacy policy after the research was done. The researcher is Nitrokey, which just happens to sell a NitroPhone without a Qualcomm chip.