I'll try answering this question in a way that allows you to re-use the technique on other privacy related questions. Generally any question about privacy boils down to WHAT information is divulged to WHO. Answering questions like this requires creating a model and taking each perspective into account. I'll take a simple model, we have three parties:
- You (Bob)
- Alice/John (receiver)
- Passive observer of the blockchain (someone analysing the blockchain)
Scenario A: I did my 2nd transaction with Alice (again) using the same ABC address.
Alice already knows the ABC address, so there is no information leak there.
The passive observer however sees a repetition of the address, it can link the two transactions to a single identity.
This is terrible if they know the real name of that single identity, but even if they don't, it could someday become useful information.
Another issue arises, especially empirically, since address re-use is slowly becoming a thing of the past. The few services that do re-use addresses are also putting the finances of the senders at risk (Alice).
Generally only one sender belongs to all transactions going to ONE address.
This is because most services generate an address for each customer, which they re-use.
Scenario B: I did my 2nd transaction with John using the same ABC address.
This would confuse the passive observer, as it could wrongly categorize the transaction from John and the one from Alice to come from the same sender.
However, the privacy leak to John is a lot larger and real. John can see how much Bob (you) received in the past. Re-using the address has exposed your transaction history and linked this address to you identity.
There are also situations where parties collude and share information, but that brings this question to the next level.
Scenario A is in most cases, the least worse of the two. In scenario B you divulged the real identity behind the address to two people, in scenario A only to one person.