If site forums use Gravatar, and the users are predominantly posting personal information about mental health issues, is this a security risk? Should the site consider turning off, or allowing opt out from Gravatar?
On one hand, these users are voluntarily participating in these public forums. On the other hand they are not disclosing their identity and likely believe their identity cannot be trivially exposed.
The risks would seem to be, site owner losing trust, and possibly violating health privacy laws in various countries with identity being considered PII.
Of course, all of this is moot if there is no technical vulnerability. The best summary I can find seems to suggest there may still be some cause for concern: https://www.wordfence.com/blog/2016/12/gravatar-advisory-protect-email-address-identity