Earlier quoted context omitted.
Google can already see every installation of every Go program/package in existence, unless you set GOPROXY=direct (or a custom proxy). The default is to use https://proxy.golang.org , which is operated by Google.
The default proxy has a privacy policy: https://sum.golang.org/privacy .
Forgive me for being cynical, but I don't like that out of the box the toolchain tries to pull all the code at `example.com/business/logic` through google servers.