In reply to Robert Smith.

I agree, this is long overdue.

However, I guess this won't happen, as my feeling is, that the Core dev team and Automattic seems not fully understand what the GDPR means in that regard. It's a shame.

I get, that some info is needed to make the update process happen properly - and by all means we need a proper update system.

But they have to at least declare in full and in public what data goes where and when and how long it is kept. And for storing the IP address they must implement a mechanism to anonymize it as that is required by GDPR.

If there is any data, that might not be essential but is only optional then the user MUST get the option to OPT-IN to also transfer that data.

That would mean another option setting in the UI, yes. And again this then has to be opt-in.

I am curious how long we have to wait for all that. If there are any legal cases around the whole thing we might get it earlier, who knows...