In reply to Greg Brown.

@Greg Brown, thanks for explaination.

All this and every third party who can access any of this needs to be specified in detail in privacy policy of wp.org, including a named contact person and postal address.

A privacy policy which only “speaks in broader terms” is not GDPR compliant.

Providing GDPR compliance is the most important feature for all EU users.

Actually current WordPress itself is not GDPR compliant due to use of Google Webfonts in Gutenberg for which there is a) no consent of user and b) it can not be switched off and c) is not necessary for a working editor.

Took part in a few core privacy chats already over a year ago, but nobody cared about my warnings, so I am out, sorry. Note that it is only a matter of time, until WordPress will be reported to EU authorities because of lack of legal compliance.