In reply to Ryan Hellyer.

Most people don't choose to interact with their services. They are unwillingly forced into them due to the nature of Gravatar. The privacy policy does not apply to those thousands of WP installs that have Gravatar enabled since no one on those sites know about it and the WP core team refuses to disclose anything about it to the end user by default. Automattic can also basically do whatever they want with the data. They are very vague in who they can give data too. From my non legal readin of the policy. But you can find extensive discussions on the subject online.
http://meta.stackexchange.com/questions/44717/is-gravatar-a-privacy-risk
http://meta.stackexchange.com/questions/4553/can-we-use-non-gravatar-avatars/5658#5658

On Gravatar website they write:
"The way gravatar requests are structured, your email address is encrypted before transmission. Your email address cannot be harvested from gravatar enabled sites due to gravatar requests."
Which is a flat out lie and they know it. They basically lie to the face of their users.
http://torquemag.io/if-you-wouldnt-say-it-in-person-would-you-say-it-online/

But oh well no one in the higher echelon of the WP community gives a damn about privacy anyway since Automattic probably makes money of the data it collects from forced optin users.

PS
There aint even a disclosure of the use of Gravatar on this site. No privacy policy anywhere. Understandably when Jeff alone ran the show. But now with Matt owning it its odd that Matt doesn't value transparency and disclosure.