Malicious code or behavior that secretly collects user data or sends it elsewhere without clear permission is considered spyware.