> Just like everything about a phone call can be recorded if a single part to the call consents (which is true by default because the recording party counts as a consenting party), everything about website interaction can be recorded for as long as someone is "doing things" on that website if whoever owns the website is okay with that (which we can be pretty sure of they are).

Good point, but an important distinction here is that when two people are having a phone conversation both parties are knowingly participating.

If both people in a conversation know that the things that they are saying are being perceived by at least one other person their expectation of privacy regarding the things they say is necessarily limited. In some jurisdictions a person's belief that the conversation is strictly private and limited to just the two of them is a reasonable expectation but other jurisdictions disagree. Those other jurisdictions instead believe that there is no reasonable expectation of privacy by one party that the conversation will not be recorded by another party to that conversation.

And so - although a reasonable belief forms the outlines of the permission granted, not all jurisdictions agree as to what constitutes "reasonable". Some states have held that they don't think the permission granted protection against single-party-recording (because those states held that this specific expectation of privacy to not be reasonable) while other states think it does (because those other states thought this specific expectation of privacy was reasonable).

But this disagreement among jurisdictions is primarily about what constitutes one's "reasonable expectations of privacy" and highlights how the "reasonable" aspect changes based on context (for example, given the ubiquity of recording devices and their use by private parties you should expect that the two-party consent requirement for phone conversations will eventually go away; at some point it is no longer "reasonable" for somebody to think that the other party will not record the conversation --- and yes there are enormous implications here w/r/t government surveillance of its citizens; Kyllo is a good example: the govt used a thermal imaging device to identify a possible marijuana grow house and then get a warrant -- but because this thermal imaging device was not in general public use SCOTUS agreed that Kyllo had a reasonable expectation of privacy and the govt's actions constituted an unreasonable search, saying that "[t]o withdraw protection of this minimum expectation would be to permit police technology to erode the privacy guaranteed by the Fourth Amendment"(1)).

Importantly though these distinctions do not change how consent and its interplay with permission-granting operates.

Which brings us to the issue at hand:

What is the reasonable expectation of privacy that the general public has when typing info into a website form but never pressing 'submit'?

It is reasonable for a user to believe that if they do not press 'submit' then that info was never submitted (otherwise why have a 'submit' button?). If the user believes the unsubmitted-info remains private and if that user's expectation is considered reasonable then that means the website lacks permission to access the unsubmitted-info.

If the website then retrieves that unsubmitted-info it does so without the user's consent. If we allow otherwise then the users' otherwise "reasonable" expectation becomes unreasonable over time.

(1)https://caselaw.findlaw.com/us-supreme-court/533/27.html