That's a good question. Although if the person has anonymized the kit at GEDmatch by giving, say, initials for a handle, and marking themself as private in the GEDCOM, I would think "child of Peggy" on Peggy's own page could no less revealing than the information on GEDmatch.
But if they have not anonymized themselves, then there are two competing points:
- by uploading their kit and not anonymizing their associated information, they have made their identifying info public already
- even though they have made their info public already, they didn't asked for attention to be called to it by naming their kit number on a WikiTree page.
While I personally lean towards point 1, I would assume that fear of the GDPR law would govern every decision these days. And since there will be cases where the person did not anonymize themselves at all on GEDmatch, the simplest policy would just be to not allow the inclusion of GEDmatch IDs in citations except when your match has created a WikiTree account and entered their own test information.
This has been brought up on GEDmatch before, by Chris Whitten himself.
https://www.wikitree.com/g2g/601685/significant-privacy-related-changes-to-wikitree-for-gdpr
(See the post itself and then also Rob Jacobson's response and then Sherrie Mitchell's.)
But the GDPR FAQ gives no clarity, so I suspect this particular point was never explicitly considered and codified into policy:
https://www.wikitree.com/wiki/Help:GDPR_FAQ#What_happened_to_DNA_test_information.3F
BTW: regarding the third cousin or closer rule, the last condition is that your prediction should match the relationship. The Shared cM project gives only a 3% chance of 2C1R sharing as little DNA as you do. Is this possibly a half-relationship? I have a 2C2R myself who shares only 10cM with me -- a 7% chance. I'm confident in the relationship, but it's good to stop and do a double-take when you see a total cM value so far off from the expected value.