After re-reading prior to posting, the following may come across a bit intimidating. 
That is not my intention, I just want to lay the facts on the table. I know that (except a few bad apples as everywhere) no one intends to do any harm, but unfortunately the definition of āharmā can differ significantly between persons (I know I personally are quite strict when it comes to privacy). When I say that certain actions are not compliant to EU legislation, I donāt want to finger-point to those currently doing it, instead my intention is to warn those that their actions may not be welcomed by everyone. Also, by quoting some of those who have responded in this topic, I donāt want to put them on the spot, their words are just good examples for me to explain the EU legal ramifications.
Letās take a step back from the preferences of individuals and have a look at the legal framework we are standing on. Thatās a difficult task, because privacy laws are extremely different across countries - from countries not even having any over countries like the USA, where (except for medical data, which is decently protected) there is almost no data protection to countries like Germany (historically) and now the complete European Union (EU), where data protection laws are very strict and fines for violations can be really high.
Disclaimer: Iām not a lawyer! Iāve dug rather deep into privacy legislation, but if you need legal counsel, please go to a lawyer specialized on data privacy legislation! The following is not legal counsel but just my personal understanding of the subject.
Postcrossing is a company registered in Portugal (and thus the EU) and represented by (I think) Portuguese citizens. That means that for the rules governing postcrossing.com (regardless where on postcrossing.com you are, forums or main site, as the telecommunications service regulations specify that a website owner is responsible for the rules on all areas of a domain, though not for the actions of individual users unless duly noted about them) Portuguese and harmonized EU legislation applies.
The EU General Data Protection Regulation (GDPR) requires prior explicit voluntary consent before collecting, processing or sharing privacy data. There are some exceptions where legitimate interests allow collecting, processimng and sharing of privacy data (e.g. video surveilance against theft in a store - there must be a notice before you enter the surveilance area, so you can avoid it). There are many ways to obtain such consent, the main Postcrossing site does it in their rules, where it is stated that the address is required to be given to random other members for them to send a postcard to you, and no other use of the address is permitted (note that Postcrossing is not responsible if the user who go an address is abusing it by giving it to others, if you find out you can sue that user). By entering your address into your Postcrossing profile you agree to this use of your address, because that is stated in the rules you accepted. Round Robins (RR) work similarly: By sending your address to the RR host, you consent that it is sent to the RR members for the purpose of the RR only. Any other use of your address by these RR members is illegal, but neither Postcrossing nor the RR host are responsible, the misconducting member can be sued.
The RAS RR in its current form does not comply with the GDPR.
You cannot use the mere fact that someone has posted in the forum or accepted the forum rules as implying they are actively consenting to participate in the RAS RR - for this to work, the page where the forum rules are accepted would need to have a (by default empty) checkbox like ācheck if you are fine with your address being used in thge RAS RRā. For the RAS RR to be legal in the EU, you need to create an opt-in list where those forum members who are fine to have their address being shared for the RAS RR can enter themselves.
Legally, that would be an opt-out solution (āyou agree unless you explicitly say that you disagreeā), but the GDPR requires an opt-in (āyou disagree unless you explicitly agreeā), and the opt-in must be voluntarily, so you canāt tie it to accepting the forum rules, it must be a separate consent (but could be on the same page, see my checkbox suggestion above).
It should be the other way round: Donāt send a note to the group unless the person explicitly allows it. Or you could put it into the RR rules that by participating the user agrees to this sharing. As a new user will need to actively seek entry into your RR, that should be legally fine.
Having said that, thatās the legal situation in the EU as I understand it. Members from outside the EU may have very different legal regulations, but Postcrossing as organization needs to comply with EU law, so the official forum rules and any other official communication (an FAQ thread pinned by @paulo or @meiadeleite might be considered official, though Iām not sure) need to take this into account and should be clearly phrased that way to avoid any legal risk to Postcrossing. As long as no one is unhappy with the way things are handled, there is no problem (in German we have a saying āWo kein KlƤger, da kein Richterā, rough translation: No plaintiff, no judge, meaning breaking this law will only have consequences if someone actually complaints), the issue with that, of course, is that you cannot be sure the there will never be a complaint. There would have been a complaint from me if 'I had ever gotten a card from the RAS RR without having been asked first if thatās fine. Yes, I understand that the idea of the RAS RR is the surprise, but remember that surprises can be unpleasant, and not all have the same taste. 
The fact that so far no one complained does not mean no one ever will.
@meiadeleite: Thank you very much for confirming that the same strong privacy rules as on the main site are also implied by the forum rules! If you or @Feuerstuhl or @maleko would like my help with rephrasing the rules, please send me a private message, Iām happy to help to the eytent of my knowledge.
) As you said as well, having clear demarcation between consenting to Forum rules and consenting to RR/RAS rules would be of legal benefit not only to users, but to Postcrossing itself.
So as a long-term member, this has never been an issue to me though I understand why it is discussed! And it is tricky!
