Perhaps he should get a definitive answer. I'm not an expert in this area, but in the first post @gregorw wrote "this needs to be documented in your EULA and privacy policy." With needs, do you mean should or must by law? Because if it's in the last mentioned case, it is important.
Suggestions and feature requests