> Without a license, copyright law forbids you from downloading and running an application

That is an idiotic interpretation of copyright that has only been upheld in some court cases. The only copy being made by the user is the transient "copy" in memory. Selling someone a download to use as software while later claiming the necessary and transient copy in memory is a violation of copyright is simply fraud at the point of sale.

> copying it to your other PC or emailing a copy to your friend

Making additional copies is an entirely separate matter. Do not confuse use of software (or any other creative work) with copying. You seem to be intentionally conflating these terms, probably because of your erroneous belief that some type of permission is needed for use.

> GPL talks about some additional things

The GPL only talks about distributing extra copies. Have you even read it? From The FSF's FAQ[1] on the GPL:

You are not required to agree to anything to merely
use software which is licensed under the GPL.

The only reason to accept the GPL is if you are redistributing GPL-licensed software and want the additional distribution rights it grants.

> But you also need it, or some license, to use the software at all.

If this was true, we'd be in real trouble because the GPL does not grant any kind of usage license. When you last used a typical Linux distro you used software without usage licenses.

> Networked services don't fall under copyright law,

Correct, though their output may fall under copyright. This is why the AGPL exists to help with the problem of immoral Services as a Software Substitute[2].

> Very few people ever give informed consent when editing Wikipedia.

Nor do they need to. The copyright issues are orthogonal to the risks associated with logging personal (meta)data. As far as I know, there isn't any hidden safety risk associated with editing Wikipedia.

> I can't be sure I fully understand them myself!

While I have studied a lot about data-exposure risks, I know that I only see a tiny portion of the risk-space. Similar to the Schneier Principle where anybody can make crypto that they themselves cannot break (i.e. you're not the smartest person in the world), the risks of data aggregation are probably more numerous than anybody realizes.

That's kind of my point: when we have potentially open-ended risk, you need to minimize your exposure. More data stored in more locations is all additional attack surface.

> Obviously this isn't practical for Internet services.

Security is often in conflict with usability. I personally think that the impact on usability can be minimized through better UI or other solution (which may not exist yet).

Perhaps something like a small set of standardized licenses that are very clear and specific in scope. People could be expected to know what those "standard agreements" mean because those licenses could be taught outside of any particular business transaction.

> Banning everything until there's a solution is neither practical nor desireable.

If the Underwriters Laboratories didn't exist, you wouldn't think it was acceptable to continue using cheap wire ("A more desirable price for the consumer!") and unsafe designs ("it isn't practical to redesign all of our products"). You would (hopefully) insist that your products shouldn't set your house on fire and that we probably need some sort of higher standard (like those provided by the UL and other safety standards).

The precautionary principle cautions that when you don't know the risk, you should take the safer path. Making products or services that create massive amounts of new attack surface with completely unknown risk is not the safe path.

[1] https://www.gnu.org/licenses/gpl-faq.en.html#ClickThrough

[2] https://www.gnu.org/philosophy/who-does-that-server-really-s...