The privacy policy was updated by the new parent company just 3 days ago, and is clearly full of legal boilerplate. They've already released a statement saying that they're going to update it to clarify.
The latest version of Audacity, 3.0.2, predates the privacy policy change, and has no ability to phone home at all.
We have visibility into Open Source Software, and will always be able to see everything that Audacity is doing. The community has the ability to build and distribute our own version of Audacity with user-hostile features removed. These are things that you cannot do with proprietary software.
For that matter, the list of information collected, "the operating system and version, the user's country based on their IP address, non-fatal error codes and messages, crash reports, and the processor in use" is certainly less than other software or web services collect. Have you read the TalkBass
Privacy Policy,
Terms Of Service,
Cookie Usage documents that you implicitly agreed to? Unlike Audacity, it actually involves collecting personally identifying information.
In my opinion, this is not "news", it's a knee-jerk sensationalist headline that will be rendered out of date in a matter of days or weeks.