In addition to tracking the printer’s online or offline status, page count, and ink levels, your rented printer will look at the types of documents you’re printing (e.g., PDF, JPG, Word), the types of devices that initiated the print job, “peripheral devices,” and other “metrics” related to the service, the All-In Plan’s terms read. This is on top of the personal information HP collects upon initiating the plan, like your location and your company name (if you have one). By signing up for the service, the terms say, you “grant to HP a non-exclusive, worldwide, royalty-free right to use, copy, store, transmit, modify, create derivative works of and display [your] non-personal data for its business purposes.”
Oh sure. They could do this. But they don’t.
But there is absolutely no way to verify what they are doing, no fear of getting caught and thus there is no incentive to behave with integrity.
At least my state of knowledge is that this: https://reproducible-builds.org/ isn’t fully functional and even if it were what HP does on their machines is closed source stuff.
And even if there were companies or organizations that are big enough to enforce transparency, like a big multinational or a government, there will be plenty of cases where smaller companies with sensitive data can’t, like doctors offices or independent lawyers.
It is way easier to charge for a “data privacy” subscription tier and then still just not honoring the wording of that, than to actually put in the effort.