WordPress GDPR Compliance

Why WordPress isn't compliant by default

WordPress powers a large share of the web, which means the same handful of compliance gaps repeat across millions of sites. The gaps are not bugs. They are sensible defaults chosen years before GDPR existed, and nobody turned them off for you.

GDPR does not care that a default caused the problem. If your site sets a tracking cookie on a visitor in Berlin before they clicked anything, that is processing without a lawful basis, and the site owner is the controller responsible for it.

The six default data leaks

1. Commenter IP addresses

WordPress writes the commenter's IP address to the comment_author_IP column of the wp_comments table. An IP address is personal data under GDPR — this was settled by the Court of Justice in Breyer. Storing it needs a lawful basis, a documented retention period, and a mention in your privacy policy. Most sites have none of the three.

Fix: stop storing it. A short filter in your theme's functions.php or a small utility plugin can blank the value before it is written.

2. The comment cookie opt-in

Since WordPress 4.9.6 the comment form includes a checkbox offering to save the commenter's name, email and site in cookies. That checkbox is compliant only when it is unticked by default. Several popular themes tick it. A pre-ticked consent box is explicitly invalid under GDPR and was the exact issue in the CJEU's Planet49 ruling.

3. Gravatar

To display an avatar, WordPress sends an MD5 hash of the commenter's email address to Gravatar, operated by Automattic in the United States. That is a disclosure of personal data to a third party and a transfer to a third country, triggered automatically for every visitor who loads a post with comments.

Fix: Settings → Discussion → untick "Show Avatars", or load avatars only after consent.

4. Embeds

Paste a YouTube URL and WordPress renders an iframe that sets Google advertising cookies on page load. The same applies to Google Maps, Vimeo, X/Twitter, Instagram and SoundCloud embeds. Each one is a third-party tracker firing before any banner appears.

Fix: use a CMP that blocks iframes until consent, or switch YouTube embeds to youtube-nocookie.com — which reduces but does not eliminate the problem.

5. Contact forms

Contact Form 7, WPForms, Gravity Forms and Ninja Forms all store submissions in your database, and most log the sender's IP by default. If a form feeds a mailing list, you need separate, explicit, unbundled consent for marketing — "by submitting this form you agree to receive our newsletter" is not valid consent.

6. Fonts, CDNs and page builders

Loading Google Fonts from Google's servers transmits every visitor's IP address to Google. A German court in Munich awarded damages over exactly this in 2022, and it triggered a wave of copycat claims. Elementor, Divi and most page builders load remote fonts by default.

Fix: self-host your fonts. It is faster anyway — this site self-hosts its two typefaces for that reason.

What WordPress already gives you

Core ships with three genuinely useful GDPR features that most site owners never open:

• Settings → Privacy — generates a privacy policy draft with sections contributed by your installed plugins. A starting point, not a finished policy.
• Tools → Export Personal Data — assembles everything core and participating plugins hold about an email address. This is your right-of-access workflow.
• Tools → Erase Personal Data — the right-to-erasure counterpart. Both send a confirmation email to the requester, which handles identity verification.

These cover data subject requests reasonably well. They do nothing about consent, which is where nearly all enforcement risk actually sits.

The seven-step fix

1. Audit what you actually collect Open your site in a private window with devtools on the Network tab. Every third-party domain that loads before you interact with the page is a script you need to account for. Most owners are surprised by the list.
2. Install a consent platform that blocks scripts Not just a banner. The plugin must prevent tags from executing until consent is given, and must record what each visitor consented to and when.
3. Publish a real privacy policy Legal bases, retention periods, third-party recipients, international transfers, and how to exercise rights. The WordPress sample text covers none of this properly.
4. Fix comments and Gravatar Stop IP logging, confirm the consent checkbox is unticked, and disable avatars or gate them behind consent.
5. Contain third-party embeds Block them behind consent, or replace them — a static map image instead of an interactive Google Map removes the tracker entirely.
6. Make forms compliant Unticked, separate consent checkboxes for marketing. Disable IP logging where you do not need it. Set a retention period for stored entries and actually enforce it.
7. Document your request process Publish a contact route for data subject requests and commit to the 30-day response window. Test it once yourself.

Choosing a consent plugin

The decision that matters is whether the plugin performs real script blocking. Everything else is secondary.

WooCommerce specifics

WooCommerce adds order records, customer accounts, and usually a payment processor and a marketing stack. Four things need attention:

• Retention settings. WooCommerce → Settings → Accounts & Privacy lets you automatically remove personal data from cancelled, failed and completed orders after a set period. Set it deliberately rather than leaving it blank.
• Marketing consent is separate from purchase. You cannot make newsletter signup a condition of checkout. That is bundled consent and it is invalid.
• Data processing agreements. Stripe, PayPal, your shipping provider and your email platform are all processors. You need a DPA with each; most publish one you accept by using the service.
• Payment and analytics scripts. Stripe's fraud detection script and any conversion pixels need to be categorised correctly — genuinely essential scripts may load pre-consent, marketing pixels may not.

The same reasoning applies on hosted platforms. See our Shopify GDPR guide and Squarespace GDPR guide for the platform-specific versions.

Five mistakes we see constantly

1. A banner with no blocking. Covered above, and it is the majority of non-compliant WordPress sites.
2. No reject button. Refusing must be as easy as accepting. "Accept" and a settings link buried in small print does not qualify.
3. Copied privacy policy. A policy lifted from another site describes that site's processing, not yours. It is also copyright infringement.
4. Ignoring the UK. Post-Brexit the UK has its own regime. If you serve UK visitors you are dealing with UK GDPR and PECR as well.
5. Setting it and forgetting it. Every new plugin can add a tracker. Re-run the devtools audit after any significant change.

Frequently asked questions

Related reading