The paper states that they studied the HTML form element interactions but “not the keystrokes or content.”

There's a big difference. Both are more invasive than we would like, but grabbing everything you type while in the app's browser is much worse than measuring a true or false "did this person submit their comment or did they give up and leave it unsubmitted."

Tiktok is getting the content of the text, which could be sensitive info, and it grabs from every site you visit, not just the social platform itself.

But I think the main issue is using the data for allegedly targeting of protestors and Chinese political opponents, more than the depth of the data collection itself.

logging statuses that were typed out, but ultimately not posted.

That's common practice across the web. For example in a lot of social networks (not Lemmy) if I were to close this reply box without clicking the "Reply" button, I'd simply be able to open it and my half written reply would be restored.

It's not about gathering data on users, it's about saving users from accidental deletion particularly on touch screens where it's so easy to accidentally brush the wrong button.

Also I'd argue anything you intentionally type into a facebook status message box, is something you're happy to share with facebook and everyone on your social network. There's no expectation of privacy and we self sensor what we type into that box.

Logging key strokes is different, there's no reason to record that anything you record (other than actually typing messages) is likely to be something the user intended to type somewhere else but didn't realise which browser window had keyboard focus.

They would be picking up all kinds of things including passwords.

Facebook and google track users across the entire web using widgets that other sites choose to embed.