They send user data? Source?

Debian has popcon, which must be enabled explicitly and that is it. It sends the list of the installed packages.