Privacy Policy for WordPress: Plugins, Comments & GDPR Compliance Guide

What WordPress Collects Out of the Box

Before you install a single plugin, WordPress itself already collects personal data in several places. Most WordPress site owners don't realize how much the default installation captures. Here is exactly what WordPress core collects, with zero plugins enabled.

Comments

When a visitor leaves a comment on your WordPress site, WordPress stores the following data:

• Name — the display name the visitor enters in the comment form
• Email address — stored in the database, visible to site administrators in the WordPress admin dashboard
• IP address — logged to the comment metadata table. Used by WordPress for spam detection. If you have Akismet enabled, this IP is also sent to Akismet servers
• Browser user agent string — the full browser identification string (e.g., "Mozilla/5.0 ..."). Stored as comment metadata. Used for spam analysis
• Gravatar hash — if the visitor used an email associated with a Gravatar account, WordPress generates an MD5 hash of the email and sends it to Gravatar servers (owned by Automattic) to retrieve the avatar image. This happens automatically — you don't need to enable anything for Gravatar lookups to occur

All of this data is stored indefinitely in the WordPress database unless you manually delete comments or configure automatic deletion in Settings → Discussion.

User Accounts

If your WordPress site allows user registration (Settings → General → "Anyone can register"), WordPress collects the following for each registered user:

• Username — public-facing identifier. Stored in the wp_users table
• Email address — used for password resets, admin notifications. Stored in wp_users
• Display name — shown publicly on posts and comments. Configurable per user
• Password hash — WordPress never stores plaintext passwords. It stores a bcrypt or phpass-hashed version. If your database is compromised, the attacker gets hashes, not passwords
• Registration date — timestamp of account creation. Stored in wp_users
• Role — subscriber, contributor, author, editor, or administrator. Stored in wp_usermeta

Administrators can see all user data from the WordPress admin dashboard (Users → All Users). Subscribers cannot see other users' data. If you have multiple administrators, they all have access to the full user database.

Cookies Set by WordPress Core

WordPress sets cookies in the visitor's browser. Here is every cookie, its purpose, and its lifespan:

Since WordPress 4.9.6 (the GDPR release), the comment cookies are opt-in — visitors see a checkbox "Save my name and email for next time" which is unchecked by default. This checkbox only appears on fresh installations; sites upgraded from before 4.9.6 may still default to checked.

Embedded Content

When you embed content from another site in a WordPress post or page — a YouTube video, a tweet, an Instagram post, a CodePen — that embedded content loads directly from the source site. WordPress does not control what those third parties collect.

The WordPress block editor (Gutenberg) embeds content as an <iframe> or as external scripts. The embedded site (YouTube, Twitter, Instagram, etc.) can set cookies, track page visits, and collect data as if the visitor had visited that site directly. Your privacy policy must disclose this because you are the one choosing to embed that content.

Server Logs

WordPress itself does not generate server logs — your hosting provider does. But server logs contain personal data: IP addresses, browser user agent strings, referring URLs, and timestamps of every page request. Your hosting provider retains logs for varying periods (24 hours to 30 days, or up to a year for some providers). This data collection must be disclosed in your privacy policy, even though it's not WordPress software doing the collecting.

The Privacy Policy Gap: Plugins You Didn't Write

Here is the fundamental problem with WordPress privacy policies: WordPress knows what WordPress collects, but WordPress doesn't know what your plugins collect.

Plugins are independent software written by third-party developers. Each plugin can:

• Store data in your WordPress database (in custom tables or as post/user meta)
• Send data to external servers (analytics services, email marketing platforms, AI APIs)
• Set its own cookies in the visitor's browser
• Add tracking scripts (pixels, analytics, heatmaps)
• Share data with unnamed third parties
• Retain data indefinitely with no built-in cleanup

WordPress's built-in Privacy Policy page generator (Settings → Privacy) includes a draft with sections for WordPress core data collection. It does not — and cannot — include sections for your plugins. The plugin directory requires plugin authors to disclose privacy practices, but enforcement is inconsistent. Many plugins have no privacy documentation at all.

Your privacy policy needs to account for ALL plugins on your site. But WordPress can't tell you what they do. This gap is your responsibility as the site owner.

How to Audit Your Plugins for Privacy

Here is a repeatable process for auditing every plugin on your WordPress site:

Step 1: List every active plugin

Go to Plugins → Installed Plugins in your WordPress admin. Write down every plugin that is active. Include must-use plugins (under /wp-content/mu-plugins/) and drop-in plugins.

Step 2: For each plugin, answer these questions

• Does the plugin collect or store personal data? If yes, what data specifically?
• Where is the data stored? WordPress database (which tables?), external cloud service, plugin developer's servers, third-party API?
• How long is the data retained? Does the plugin offer data retention settings?
• Does the plugin share data with third parties? Which ones? Under what terms?
• Does the plugin set cookies, localStorage, or other browser storage? For what purpose?
• Does the plugin offer GDPR compliance features (data export hooks, data erasure hooks, consent mechanisms)?
• Does the plugin have its own privacy policy? Where can users read it?

Step 3: High-privacy-risk plugin categories

These plugin types almost always collect personal data and need close attention:

Step 4: Check each plugin's privacy documentation

WordPress.org plugin directory now requires privacy disclosures in the plugin description. To find them:

1. Go to the plugin page on WordPress.org
2. Scroll to the "Privacy" section in the plugin description (if it exists)
3. Look for a dedicated privacy page linked from the plugin's readme or settings
4. Search for the plugin name + "privacy policy" + "GDPR"

If a plugin has no privacy documentation, that doesn't mean it collects no data — it means the developer hasn't documented what it collects. Assume it collects something. Contact the developer or consider replacing the plugin.

WordPress's Built-in Privacy Tools (Since WP 4.9.6)

WordPress 4.9.6, released May 2018 in direct response to GDPR enforcement, introduced three key privacy features. If you're running an older version of WordPress, these tools do not exist — upgrade.

Privacy Policy Page Generator

Located at Settings → Privacy in your WordPress admin. WordPress can create a draft privacy policy page for you. The generated page includes sections covering all of WordPress core's data collection (comments, user accounts, cookies, embedded content).

What it does well: Accurately describes what WordPress core collects. Includes placeholder text for cookies, embedded content, and data sharing. Structure is compliant out of the box for a plain WordPress site with no plugins.

What it doesn't do: It cannot add sections for your plugins. Every plugin that collects data requires its own section. The generated page is a starting point, not a finished policy. You must edit the page and add plugin-specific disclosures.

Export Personal Data Tool

Located at Tools → Export Personal Data. Any user (or administrator acting for a user) can request a data export. WordPress will:

• Collect all comments by that user from the wp_comments table
• Collect all user meta data from wp_usermeta
• Package everything into a JSON or HTML file available for download
• Notify plugins to hook into the export process and include their own stored data

Critical test: Run an export request for your own user account. Download the resulting file. Open it and check what data is included. If a plugin's data is missing (e.g., contact form submissions from a form builder plugin), that plugin is NOT hooking into the WordPress privacy API and is NOT GDPR-compliant.

Plugins that properly integrate will appear in the export automatically. If the export is missing data from a plugin that stores personal data, you have a compliance gap.

Erase Personal Data Tool

Located at Tools → Erase Personal Data. Same mechanism as export, but in reverse. WordPress will:

• Anonymize or delete comments by that user
• Delete or anonymize user meta
• Notify plugins to do the same via the privacy API

Same test applies: If you erase your test account's data and plugin data remains in the database, that plugin is not complying with data erasure requests. You must either replace the plugin, fix the plugin, or manually delete that data when erasure requests come in.

Template: What to Add to Your WordPress Privacy Policy

Below are the sections you need in your WordPress privacy policy. Customize each based on the plugins you actually run.

Section: Comments

"When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor's IP address and browser user agent string to help spam detection. An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment."

(This is the exact text WordPress generates in its default privacy policy. It's accurate. Keep it.)

Section: Cookies

"If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select 'Remember Me', your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after one day."

Add to this section: List any cookies your plugins set. Use a browser tool (like Chrome DevTools → Application → Cookies) to identify third-party cookies from analytics services, social sharing buttons, consent management platforms, and advertising networks.

Section: Embedded Content

"Articles on this site may include embedded content (e.g., videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website."

Add to this section: List which third-party sites you embed from. "We embed content from YouTube, Twitter/X, and Instagram. Please review their privacy policies for details on their data collection practices."

Section: Analytics

"We use [service name] to analyze how visitors use our site. [Service name] collects anonymized data such as page views, session duration, and browser type. Your IP address is anonymized [if applicable — Google Analytics can do IP anonymization]. Data is retained for [duration]. You can opt out of [service name] tracking by [link to opt-out or browser extension]."

Customize for: Google Analytics 4 (mention data sharing with Google and the Google Ads data processing terms), Matomo (self-hosted vs cloud, IP anonymization settings), Jetpack Stats (data flows through WordPress.com servers, Automattic privacy policy applies), Plausible or Fathom (privacy-focused, minimal data, but still disclose).

Section: Contact Forms

"We use [plugin name] for contact forms. When you submit a form, we collect your name, email address, and your message. Submissions are stored in our site's database and may be sent to us by email. Data is retained for [duration, e.g., "12 months"] and then automatically deleted. We do not use this data for marketing purposes without your explicit consent."

Critical detail to add: If your contact form plugin stores submissions in the database AND sends them by email, you have two copies of the data. Both must be accounted for in erasure requests. Most WordPress contact form plugins (Contact Form 7, WPForms, Gravity Forms) store form entries indefinitely unless you configure deletion schedules.

Section: Email Marketing

"We use [service name, e.g., Mailchimp] to manage our email newsletter. When you subscribe, your email address and name are sent to [service name] and stored on their servers. We use [service name] to send emails, track opens, and manage unsubscribes. You can unsubscribe at any time using the link at the bottom of every email. [Service name]'s privacy policy applies to data stored on their systems."

Required disclosure: You must name the email service provider. GDPR Article 13 requires you to identify all data controllers and processors. Your email marketing provider is a data processor — users have the right to know who their data is being sent to.

Section: Who We Share Your Data With

"We share your data with the following third parties:

• Hosting provider ([name]) — server logs containing IP addresses and browser user agent strings
• Analytics provider ([name]) — anonymized visitor data
• Email provider ([name]) — email address and name for newsletters
• Payment processor ([name], if e-commerce) — payment data for order processing
• Spam detection ([name], e.g., Akismet) — comment data for spam analysis
• Embedded content providers ([names]) — as described in the embedded content section

Each of these third parties has their own privacy policy governing how they handle your data."

WooCommerce-Specific Privacy Considerations

If you run an e-commerce site with WooCommerce, your privacy obligations are significantly greater than a simple blog. Here is what WooCommerce collects and how to handle it in your privacy policy.

Customer Accounts

WooCommerce stores the following data when a customer creates an account or places an order:

• Name — billing and shipping first and last names
• Email address — stored with the account and on every order record
• Billing address — street address, city, state/postcode, country, phone number
• Shipping address — same fields as billing address. May be different from billing address
• Order history — every product purchased, date, amount, payment method, order status
• IP address — stored with each order for fraud analysis
• Browser user agent — also stored with order data

All of this data is stored in your WordPress database indefinitely by default. WooCommerce does not automatically delete old customer data.

Payment Data

WooCommerce itself does not store full credit card numbers. Credit card data goes directly to your payment processor (Stripe, PayPal, Square) through their hosted checkout forms or via the Payment Request API. However, WooCommerce does store:

• The last 4 digits of the card number
• The card expiry date
• The billing address associated with the card
• The payment method type (Visa, Mastercard, PayPal)

Your privacy policy must disclose that payment data is transmitted to the payment processor and subject to the processor's privacy policy. You must link to Stripe's, PayPal's, or Square's privacy policy as applicable.

WooCommerce Analytics

WooCommerce includes built-in analytics (Analytics → Dashboard in the admin) that tracks customer journey data:

• Products viewed
• Products added to cart
• Cart abandonment
• Completed purchases
• Customer lifetime value

This data is stored in your WordPress database using WooCommerce's custom analytics tables (wc_order_stats, wc_customer_lookup, etc.). It does not leave your server unless you've connected WooCommerce to an external analytics service (like Google Analytics through a plugin).

Tax and Legal Compliance vs. GDPR Deletion

Here is the conflict every WooCommerce store faces: GDPR gives users the right to erasure, but tax law requires you to keep records for 6-10 years depending on your jurisdiction (EU VAT directive: 10 years. US IRS: 7 years. UK HMRC: 6 years).

WordPress and WooCommerce handle this through the "anonymize" approach in the Erase Personal Data tool. When you process an erasure request:

• Customer name is replaced with "Anonymous"
• Email address is replaced with a placeholder
• IP address is removed
• Order data (products purchased, amount, date) is retained for tax compliance

This is the correct approach. You cannot fully delete order records. Your privacy policy must explain this limitation clearly: "We retain order data for [6/7/10] years as required by tax law. When you request data erasure, we anonymize your personal information but keep the order record for legal compliance."

Shipping Plugins and Third-Party Data Processors

If you use shipping plugins like ShipStation, Easyship, WooCommerce Shipping, or Shippo, your customer's name and address are sent to that provider. Each shipping provider is a separate data processor:

• ShipStation — customer name + address + order details sent to ShipStation's cloud for label generation
• Easyship — same data, plus package dimensions and declared value for customs forms
• WooCommerce Shipping (USPS/Ups) — sends customer address directly to the carrier API

You need to disclose each shipping provider as a data processor in your privacy policy. You also need a Data Processing Agreement (DPA) with each provider. Most major shipping providers have DPAs available; smaller ones may not — choose providers that take data protection seriously.

GDPR Compliance Gaps in Common WordPress Setups

Here are the most common mistakes WordPress site owners make with GDPR compliance. Check if any apply to your site.

Akismet Spam Filtering

Akismet is included with every WordPress installation. Even if you never activated it, you may have it installed. Akismet sends every comment — including the commenter's name, email, IP address, and user agent — to Akismet servers (owned by Automattic) for spam analysis. If a comment is marked as spam, the full data stays on Akismet's servers.

What to do: Disclose Akismet as a data processor in your privacy policy. "We use Akismet to detect spam comments. Comment data (name, email, IP address, browser user agent) is sent to Akismet servers for automated spam analysis. Akismet is operated by Automattic. Their privacy policy applies to data processed by Akismet." Or remove Akismet and use a server-side spam filter instead.

Jetpack

Jetpack is one of the most privacy-invasive plugins on WordPress.org because it touches everything: stats, social sharing, related posts, CDN, brute force protection, and more. Every Jetpack feature that touches your visitors sends data through WordPress.com servers (also Automattic).

What to do: Review every Jetpack module you have enabled. Disable any that send data unnecessarily. For the modules you keep, disclose each one in your privacy policy. "Jetpack Site Stats collects anonymized visitor data and processes it on WordPress.com servers. Jetpack's privacy policy applies." Consider whether you can replace individual Jetpack features with privacy-friendlier alternatives (e.g., Plausible for analytics, Cloudflare for CDN).

Google Fonts

If your WordPress theme loads Google Fonts from Google's CDN (the default for most premium themes), every visitor's IP address is sent to Google when the page loads. Multiple German courts (Landgericht Munchen I, Landgericht Hamburg) have ruled that loading Google Fonts from Google's CDN without consent violates GDPR.

What to do: Two options. Option 1: Self-host Google Fonts on your own server. Many WordPress plugins exist for this ("Host Google Fonts Locally," "OMGF"). Option 2: Use a privacy-focused font service like Bunny Fonts (formerly Google Fonts proxy, GDPR-compliant by design). Option 3: Use system fonts only — they load instantly, no data leaves your server.

reCAPTCHA

Google reCAPTCHA is used by many contact form plugins (Contact Form 7, WPForms, Elementor Forms) to block spam. It loads JavaScript from Google's servers and sends visitor behavior data to Google — including mouse movements, scroll patterns, and keystroke timing. This profiling data is used to determine whether the visitor is human.

What to do: reCAPTCHA requires disclosure AND cookie consent in the EU. Your cookie consent banner must include reCAPTCHA as a tracker. Even with reCAPTCHA v3 (invisible, no checkbox), Google still processes visitor data. Alternative: use a privacy-friendly captcha like hCaptcha (GDPR-compliant, pays publishers), Cloudflare Turnstile, or a math-based captcha that requires no external requests.

YouTube Embeds

When you embed a YouTube video in a WordPress post using the default WordPress block editor, the embed uses YouTube's standard domain (youtube.com). YouTube embeds load tracking scripts, set cookies (including advertising cookies for logged-in users), and may serve personalized ads based on the visitor's YouTube history.

What to do: Replace youtube.com with youtube-nocookie.com in your embed URLs. For existing embeds, you can use a plugin that replaces YouTube embeds with privacy-friendly versions, or use a consent-based approach where the embed is replaced with a placeholder until the visitor clicks to load it. WordPress's built-in embed block does not support youtube-nocookie.com natively — you need a plugin or a custom embed filter.

Facebook/Twitter/Instagram Embeds and Pixels

If your site embeds social media posts or has social sharing buttons that load JavaScript from Facebook/Twitter/Instagram, these scripts track visitor behavior across the web. The Facebook Pixel is especially problematic — it reports visitor actions (page views, purchases, signups) back to Facebook for ad targeting, even if the visitor is not logged into Facebook.

What to do: Remove social media tracking scripts unless you absolutely need them for advertising. If you use the Facebook Pixel for conversion tracking, you need: (1) disclosure in your privacy policy, (2) cookie consent that covers Facebook tracking, (3) a Data Processing Agreement with Facebook. Replace social sharing buttons with static links (no JavaScript) that open the share URL directly.

Using Our Privacy Policy Generator for WordPress

Writing a WordPress privacy policy from scratch is time-consuming and error-prone. The built-in WordPress generator covers core only. You need a tool that can produce a complete, site-specific policy that accounts for your plugins.

Our privacy policy generator lets you specify "Website/Blog" as the business type and "WordPress" as your platform. You then select the categories of plugins you use — contact forms, analytics, e-commerce, email marketing, security, and more — and the generator produces a privacy policy with:

• Sections for every data collection point described in this guide
• Plugin-specific disclosures based on the categories you select
• Cookie descriptions with durations
• Embedded content disclosure
• Third-party data sharing table
• WooCommerce-specific sections if you select e-commerce
• GDPR-compliant language for data subject rights (access, rectification, erasure, portability)
• Specific disclosures for Akismet, Jetpack, Google Fonts, reCAPTCHA, and YouTube embeds

But you still need to audit your plugins. No generator can know what every WordPress plugin does. Use the audit process in Section 3 of this guide, then customize the generated policy to match your actual plugin list.

Generate a WordPress-specific privacy policy for your site
Open Privacy Policy Generator →