Currently, SE allows user to embed arbitrary images (from HTTPS sources) into posts and into comments in chat. The consequence of this is that whoever controls the server those images are hosted on can track visits to the page the image is embedded.
While the IP address and browser user agent alone might not be personal information, especially in chat it is likely that someone could connect those to SE users.
This is not a new concern, there have been several meta posts about this issue before:
- Allowing images from external sources opens doors to serious security exploits
- Disallow new embedded images from hosts other than the SE imgur account
There are also more than just these privacy issues with allowing image embedding from other sources like those images becoming unavailable after a while.
SE has a useable internal image hosting feature for many years now, there is no need to still allow users to embed images from other sources, given the potential issues with this.
Handling the existing embedded images is a bit more tricky. Converting them into plain links without embedding the images is probably the easiest way to handle this without too much effort.
I'm not a lawyer, I don't have the necessary knowledge to decide whether this is an issue according to the GDPR. But with the recent focus on data collection and handling I think it makes sense to revisit it, and maybe just to fix this even if does not violate the letter of the law after all.