Always opt out of the non-mandatory spying via the usual "no thanks" checkboxes, but much more importantly: I just assume that everything I do on that phone is logged and correlated to my real identity... even if not by Google themselves then the government agencies they are being forced by to hand over data.
If an app asks for more permission than it should need to operate, I won't install it.
By default I decline every permission request until something breaks in the app and I realize the permission request was legit.
Only the most obvious ones I allow without letting it break first, like the camera app needing access to the camera, pictures...