Historically it was always interesting and quite challenging legal work, reconciling some things a bit like this with privacy, lawful intercept and anti-remote-exploitation-tool (anti-trojan) laws, especially in Europe (think: the cookie rule, which goes beyond cookies and PII). Then again, more recently mobile apps and operating systems (on all platforms, e.g. desktop OSs) seem to be doing quite a lot of it, so maybe those legal concerns were overblown.