In reply to Claudia Schraber.

Thank you for your remarks regarding GDPR compliance.

You're right that in its default configuration Emoji Mart accesses https://unpkg.com but only when opening the Emoji Picker in the Block Editor not on the Frontend itself.
Fortunately accessing the CDN is not a requirement and in the current release (v1.0.3) Emoji Toolbar has been configured to load the "os-specific" native Emojis. A positive side effect is the performance improvement when opening the Picker 😲

As long as its implemented and configured correctly Emoji Mart should be safe to use - even in privacy concerned environments.
By the way. Nextcloud which is "GDPR compliant by Design" also includes the Emoji Mart library https://github.com/nextcloud/nextcloud-vue/blob/master/src/components/EmojiPicker/EmojiPicker.vue#L116

Thanks again for your pointing out your concerns which help to improve the Plugin.