wrote:
I just built a new machine. I think I remember reading that Microsoft
was adding some of the Windows 10 snooping capabilities to Windows 7
updates. I'm just wondering if that's true, and how to tell which
updates to avoid if it is.

Install Windows 7 SP1.

When it comes up for the first time, have the network cable
unplugged.

Find the Automatic Updates control panel in Control Panels
and set it to "don't check for updates".

*******

On some computer, visit wsusoffline.net and get
the latest version. When you run it, it has a section
entitled "Legacy", and it has a few tick boxes for Windows 7.

If you select "include SP1 files", the total size of the downloaded
collection of Windows Updates will be around 8GB. If your install
media already included SP1 (check the version listed in the
System control panel), then you don't need to "collect" the
SP1 x86 and x64 files.

wsusoffline_win7.7z (store mode) 8,102,098,105 bytes

You go to the Client folder and there should be UpdateInstaller.exe
On a machine needing Windows 7 updates, that's the file that
kicks off the install. It takes around 2.5 hours and five reboots
for the whole procedure. (It'll do a few, ask for a reboot,
it knows how many are done and what phase comes next.)

The files come straight from Microsoft, and are not downloaded
from the wsusoffline.net site itself.

http://download.wsusoffline.net/

05.08.2019 Version 11.8 (Hashes, AV check)

When you're in the "collecting" phase of filling up
the folder with the 200 updates, there is a tick
box for "security-only" jumbo updates, the ones
that don't have CEIP and the UWP library files
for running "universal" apps.

Firefox has a Mozilla version of CEIP inside it.
They collect information of various sorts, for
engineering purposes. Like, if a release has
a memory leak, they can scan all the copies of
Firefox running out there, and see what percentage
of browsers leaked 2GB of memory. It allows determining
what kind of a mess they're making.

The Microsoft CEIP adds one twist. A developer adds
CEIP calls to their code. During runtime, the program
can report things. But, the report packets go to a
Microsoft server, not to the developers server.
Later, the developer logs in and uses some tool to
examine the statistics gathered. This means that
Microsoft gets to see everything that is collected.
There are some people who don't think this is a good
idea.

While Firefox could add Microsoft CEIP calls, as far
as I know, they don't. They didn't invent their
elaborate schemes for nothing. They've been working
on instrumenting Firefox for years, and have their
own ideas how best to do it.

Anyway, this is the collecting tick box to note before
starting the Win7 updates collection.

https://i.postimg.cc/sfYGtYyP/wsus.gif

Microsoft also makes a "Convenience Rollup". It includes
CEIP and the UWP library. It is slightly faster than using
WSUSOffline, but by the time you do all the fooling around
to get stuff to run, it comes remarkably close to taking
2.5 hours too.

Whether avoiding CEIP and some library, is enough to
be wearing a tinfoil hat, that's for you to decide.
I think for the people doing this, it's not the technical
issues, it's "the nerve of some people" aspect. Microsoft
doesn't put useful improvements in Windows 7, just the
improvements that enable a business plan. I think that's
the angle people who avoid these things are using.

Paul