I am very well aware of it, as a contributor, though I don’t live in the EU. And the author/creator of the plugin lives in the EU. The latest version adds some information on this into the plugin to try and make it clearer, but we continue to try to improve. Will try to clarify…This is a bit of a long explanation, but I feel that others may ask this question and want to try to help with the answer.
Disclaimer: Some of this is my interpretation and opinion. Anything technical is a fact as I understand it.
A webmention consists of two properties. A source URL and a target URL. So, when I link to a page on another site, a webmention is sent to that page if it supports it, telling it that I linked to it. The webmention plugin on the target side then generates and displays a link showing that site name(which it extracts from the title of the page) linked to that posts. Even under GDPR, linking to another site is not a personal data violation. Therefore, that is fine.
Now, there is a debate as to whether storing the IP address of the webmention is storing data. Webmention doesn’t actually need to do it…but WordPress does it for new comments by default. WordPress itself is looking into anonymizing that data to avoid the issue, and even though I myself don’t agree with that interpretation of the GDPR for personal use, as it doesn’t add anything to the presentation, I was going to, when the new functions are added, ensure they are applied to webmentions, which is a type of comment.
If you are concerned about data collection, the second plugin, Semantic Linkbacks, which is separate, is not required. But, I think the experience of Semantic Linkbacks is worth installing. Semantic Linkbacks reads the URL of the page that sends you the webmention for more information.
So that means it goes and looks at your page for your site name and author name, and instead of the generic page title, it tries to format your webmention as a better comment. It finds the name of the author of the page, the site name, title, etc.
But, webmentions require affirmative action. You have to link to me. Someone has to send one. If you didn’t want that outcome, why install the plugin that has this feature? So, if you have a privacy policy, you probably should outline that you receive webmentions and what you do with them…namely, display them.
So, the data that Semantic Linkbacks extracts does include information if your site is marked up to support it. So, if your author image is marked up as such, it will note this so it can display it. The image on your site is one you yourself chose to represent you. Same with the other information. It is basically trying to represent the link you made to the site accurately.
Any site that receives webmentions should respect any request to remove their display or purge the information. But webmention itself allows for this. If you send another webmention, it will update. So, if you take down the page, send another webmention and it will purge the comment. There’s even a form built into the Webmention plugin for that.
Under GDPR t0 my understanding, you have a right to see what data a site has on you and get a copy of it…we have that covered because the data is a copy of the page you yourself created. You have the right to correct incorrect data…there’s the update webmention functionality.
And if we didn’t, WordPress is building in tools for data export, deletion, and anomymization…regrettably though, they use email address as a way to extract comment and user data…something the plugin doesn’t collect.
I won’t speak for Matthias Pfefferle, who authored the plugin and has been kind enough to put up with my submissions to it, but he’s given me the impression that he takes this very seriously. And even though I don’t agree with the way people seem to be applying GDPR concerns to this, I respect their concerns enough to try to address them through plugin enhancements that will allow better controls over this.
As another side note, the WordPress Core team, who is scrambling to add GDPR tools to WordPress itself, didn’t consider Pingbacks and Trackbacks, built into WordPress, to be something to address as a GDPR concern to my knowledge. Webmention functions the same way as those two in terms of what it does, although it is a newer specification.