By opening this question, you have automatically sent some data to some random website on the internet, the website hosting the above picture. What data? This is the data that is usually sent:
- Your IP
- A cookie
- The URL you are visiting (the URL of this question)
- Your user-agent (typically including OS version, browser version, etc.)
- The time when you first saw this picture (header: if-modified-since)
This can definitely be personal data according to the GDPR, and in practice in most cases it is.
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
That data is sent somewhere automatically. Did you see any privacy policies? Did you accept anything? No, you don't know how that data will be used. Of course it could be sent to a stupid random website, that will never use it for anything. Or it could be sent to a big corporation, or to a content delivery network, or any website that is big enough to be able to track you with this data, because they have a lot of services (or just hotlinked images) around spread all over the web. Note: the data is actually sent to Imgur, which I believe would definitely be able to track you, given the huge amount of pictures on the internet that link to them.
I've always seen people mainly worried about third-party assets (Google Analytics or Facebook buttons, etc.), some also began to worry about Google Fonts (that's a third-party asset too actually), but I don't think anybody ever brought up the issue of hotlinked images. That's third-party stuff. And communities like this one are basically allowing users to embed third party assets.
Who's responsible for this? Is it the user's fault, because they should always make sure the image source complies with the GDPR? I doubt it. The website owner's fault (Stackexchange), because they should not allow hotlinking? I'd say yeah, probably. Or the third-party website's fault, for not complying with the GDPR? I'd say no, for all we know they could be based in a country that doesn't even know what the GDPR is.
So my conclusion is that hotlinking should be treated like loading a third-party asset, and if the website owner cannot check the privacy policies of every hotlinked image (for example because it would be impossible in a community like this one), then unsupervised hotlinking should be disabled because the GDPR does not allow it. Am I wrong?