Quoting Paul Wise <p...@debian.org>:
A new empty package would be better than just removing it but the user would not get any notification about why the functionality is gone nor any information about the privacy violations they were subject to.
Would NEWS.Debian be sufficient?