Does Drupal 8 core by default collect visitors data? I am searching a lot since last few days but not getting an answer. I am in process of preparing Privacy Policy of site. I am not providing any user registration or user login facility but anonymous user can post comments. Now, question arises after I read following Q&amp;A on DA,

Don't collect IP addresses in Drupal 7

Now, since I have no intention to collect any user information(have not enabled statistics module), then I can simply write, "I do not collect any user information". Again, question comes, what if the code is collecting IP address/Hostname without our knowledge. 

So, if there is a way to know what information are collected, and how saved then we can be sure about that, and can state in privacy policy or If Drupal core is not collecting any data, then also we can be sure about that  and write "We do not collect any visitor's data". Is there a way we can know?

Note: Please let me know, if this question is going toward Privacy policy(away from drupal), I will move this to SO. But, again it is related Drupal CMS code, so I thought to ask here first.



UPDATE:

Have raised the issue at Drupal core: Legal privacy policy statement of Drupal core

and it you see the comment there is a link to other issue: Privacy Concerns as GDPR Compliance, which says there is already work going on and regarding this module creation is underway, module will be General Data Protection Regulation.

Please add comments in issue, if you want to add some suggestion.
The answers and comments in the linked question for Drupal 7 are still valid, with one exception. Drupal 8 gets the client ip address from Symfony\Component\HttpFoundation::getClientIps(). This returns the client ip from the header REMOTE_ADDR, unless you set up a trusted proxy. In this case you would have to configure this proxy to obfuscate the visitor's data.

In all other cases it should be enough to overwrite part or all of the ip address in a Symfony middleware.