It is a privacy leak to tell Github about what other websites or products you are using, that you otherwise wouldn't if you just used normal email/password signup.

GDPR only has a tangental relation to privacy. It might be "GDPR compliant" for me to publish my nudes to twitter, but I've still (voluntarily) lost some privacy for doing so.