Either enable "ask every time" by default or replace it with its opposite.
Reasoning
Many users may just click on continue without realizing that the selected Matrix server will receive all preview requests in the future (or until the). If that first one is not their own home server, this may result in an unnecessary leak of user data. (e.g. first I preview a user on malicious.matrix.example and accept previews there (more for this one case) and then preview users which are on other.matrix.example, the malicious one will not only know my IP but also know which user I wanted to write with).
Selecting this preview server should be an action which requires explicit agreement with knowing the consequences and not just "yeah, I want to preview this users image of course by asking his home server, why do you even ask".
This is not just my opinion but a requirement of the GDPR in the EU.
Requested Change
Either enable "ask every time" by default or replace it with its opposite.
Reasoning
Many users may just click on continue without realizing that the selected Matrix server will receive all preview requests in the future (or until the). If that first one is not their own home server, this may result in an unnecessary leak of user data. (e.g. first I preview a user on malicious.matrix.example and accept previews there (more for this one case) and then preview users which are on other.matrix.example, the malicious one will not only know my IP but also know which user I wanted to write with).
Selecting this preview server should be an action which requires explicit agreement with knowing the consequences and not just "yeah, I want to preview this users image of course by asking his home server, why do you even ask". This is not just my opinion but a requirement of the GDPR in the EU.