I'm still not sure what you're saying, you're still downloading the source from an external website on the internet, which I would expect would have a privacy policy, and would do things like comply with the GDPR. And presumably, the ports collection is getting the original source from upstreams, which could be on github or a similar service, so you can't sidestep that if you want to maintain your own ports tree.

It absolutely does have to do with analytics: in particular, Debian has an opt-in anayltics system called "popcon" which is mentioned in the privacy policy.