I'm creating a website where I collect the name, email, state, and an optional photo of a user. Before the user submits the form, they have to agree to the terms of the site. For testing and statistics, i'd like to collect IP address and user agents. Do I have to let the user know i'm gathering this on the terms page?
As paulmorriss mentioned in the comments, most major web servers do this automatically anyways, with their server logs. These logs contain UA strings, IP addresses, and much more.
I don't know of any law on the books that would explicitly forbid this, but I would say that you should probably include in the Terms of Service the fact that you collect this information for statistical purposes.
Major search engines do this too.
After a period (between 6 and 18 months), logs have all the IPs replaced by another unique identifier generated randomly for each IP. That way you can measure user behavior without identifying the user.
You can do this immediately instead by converting IPs into something else using a hash and tagging with Geo-Location information (for example). That way you do not keep user's actual IP but you have enough information to do the certain types of analysis.