I think it would be nice if there was a policy of disclosing any features which can be used to track you. A lot of plugins and themes implement code which could be used to track you, even though they most likely don't.

I don't think a rule like that would be implemented any time soon though, since WordPress itself would fail such a rule quite badly, but I do think it would be a good thing.