Yes, I'd read that. I wouldn't consider that phoning home every hour only covers 'crashes or critical events', especially when the device is running perfectly and the controller UI reports no issues. Bypassing the firewall on a USG to get the telemetry home, switching from the AP to the controller if the former is bocked, and switching between multiple domains to keep on harvesting data doesn't, to my mind, align with "there also are no penalties for blocking Internet access to the device, dropping traffic to this host, and/or blocking it via DNS.".

Since they state they're collecting MAC addresses and IPs (defined specifically as personal data under GDPR), I'm not sure how collecting this without my explicit informed consent and opt-in is as compliant as they say. Especially when they're bypassing my attempts to opt out, by changing the source of the telemetry, and the domains used, to get around my explicit determination to stop them taking such data from me. Their 'privacy policy and EULA' are meaningless when in conflict with the prevailing legislation.