Upvotes seem to just federate as likes and dislikes.
There’s no way that isn’t going to be abused. Some marketing or tracking agency will setup a fediverse server and just collect all data like this for free. Or worse, take advantage of a friendica instance to bombard it with requests for data collection purposes.
Well yes, the whole concept of the fediverse is that of social media as a public service. All activitypub data is public.
Yes, but as long as you don’t reveal your identity, they can’t do much to track you.
They don’t have access to your IP.
Of course, it you’re using the same username over multiple services, or reveal identifying information (which is much easier to analyse now due to AI) they will be able to track you.
Is IP not logged anywhere in Lemmy/ ActivityPub?
Nope just server