AllThingsD talked to Carrier IQ about what is captured via their monitoring software and how it is used. My favorite excerpt:

[…] CIQ still has the ability to capture a wide variety of user data. So who is determining what exactly is being collected?

The carriers. They decide what’s to be collected and how long it’s stored — typically about 30 days. And according to Carrier IQ, the data is in their control the whole time.

“It’s the operator that determines what data is collected,” says Carrier IQ CEO Larry Lenhart. “They make that decision based on their privacy standards and their agreement with their users, and we implement it.”

On this point, Lenhart is particularly emphatic. “We capture only the data they specify, and provide it to them,” he reiterates. “We don’t capture more than that.” […]

It’s like a game of hot potato, and all parties—including the very company responsible for making the monitoring software—are pushing the blame onto the carriers.