Re: "consider consequences on multiple levels prior to publishing private data"
"And, no, opt-out is not enough - people should at least have to opt-in to any data collection"
Strava is a data-collection site. That's what it does. You opt-in by uploading your stuff to jt, it doesn't magically track you without consent.
When I signed up the privacy zone was in the initial setup wizard, so it's a little deceptive for the article to call it off by default. It has to be off as far as it is, because Strava doesn't know where to put it unless you tell it.
Heatmap is just another example of it being really hard to anonymise through aggregation.