There are laws that limit your ability to collect certain types of sensitive information without some quasi-meaningful user consent, but most telemetry goes around this by notionally not collecting PII.
The gotcha is that in practice, most companies don't put a whole lot of effort into making sure there's no incidental PII in the telemetry, and no other way to infer who you are. Browsers automatically collect crash reports that, for a good while, might have contained your cookies, URLs, and other goodies in the logs or memory dumps... cars collect "anonymized" telemetry that shows you driving from your single-family home to wherever you're headed... etc.