{gravatar} shows the picture a person registered for their e-mail address at gravatar.com (tags/_lib/gravatar.php). The address itself never leaves the page: the image address is https://www.gravatar.com/avatar/<sha256>?s=<size>&d=<default>, made from the SHA-256 hash of the trimmed, lower-cased address.

The <img class="pad-gravatar"> carries width and height, loading="lazy", decoding="async", referrerpolicy="no-referrer" and a srcset at twice the size. default chooses what Gravatar shows for an address it does not know.

Showing the picture still tells Gravatar the visitor's IP address. For a page whose privacy policy allows no outside requests - or a test without network - fallback draws a picture on the server instead and writes no <img> at all: fallback='avatar' the {avatar} initials of alt (or of the address), fallback='identicon' the {identicon} of the address.

A missing address, an unknown default or fallback is an error under the strict check.