> Where do we draw the line as companies in terms of user data collection? Should we stop tracking our users entirely?

Well then "Login" would stop working. I think there is no universal line. Just inform users of what you are collecting.