WordPress and GDPR
No plugin makes a site compliant. What a plugin can do is handle the paperwork around decisions you already made, and the decisions are about which third parties see your visitors.
A plugin cannot make a site compliant. Compliance rests on what personal data you collect, why, who else receives it and how long you keep it. Those are your answers, not a setting. What software genuinely helps with is presenting the banner, blocking third-party scripts until consent, and servicing access requests.
This page covers the technical surfaces on a WordPress site. It is not legal advice, and where the stakes are real you want someone qualified looking at your specific situation.
What WordPress collects without any plugins
Most site owners underestimate this list:
| Where | What is stored |
|---|---|
| Comments | Name, email, optional website, IP address, browser user agent |
| User accounts | Username, email, display name, last login, session tokens |
| Contact form entries | Whatever the form asks, if the plugin saves to the database |
| Media uploads | The original file, including any EXIF data such as GPS coordinates |
| Server access logs | Every visitor's IP address, page and user agent |
| Backups | A frozen copy of all of the above, wherever it is stored |
The comment row is the one people forget. Storing an IP address for every commenter is a default, not a choice you made, and it is personal data. If your site does not need comments at all, removing them removes the whole category, as disabling comments in WordPress covers.
The media point is worth checking once. A photograph taken on a phone carries the location it was taken in. WordPress keeps the original file as uploaded, so publishing holiday photographs can publish coordinates with them. What the uploads folder does and does not hold is described in the WordPress media library.
The built-in tools nobody uses
WordPress has shipped privacy tooling since 4.9.6, and most site owners have never opened it.
- Settings → Privacy. Select the page that holds your privacy policy, and read the suggested text WordPress drafts for you. That draft lists what core stores, which is a useful starting inventory even if you rewrite every word.
- Tools → Export Personal Data. Enter an email address, and WordPress assembles what it holds about that person, including data from plugins that implement the exporter hook. The person receives a confirmation link before anything is generated.
- Tools → Erase Personal Data. The same flow for deletion requests.
Both tools depend on plugins registering their own exporters and erasers. Well-built ones do; many do not. Run an export against your own email address on a site with a few form entries and see what actually comes back. The gap between what comes back and what you know is stored is your real exposure.
Third parties are where the data goes
This is the part that produces most of the actual risk, because it happens before anyone clicks anything.
Every script, font, embed and image loaded from another domain sends the visitor's IP address to that domain as a condition of loading. The visitor never agreed to it and usually cannot tell it happened.
Common sources on a WordPress site:
- Analytics. The obvious one, and the one people do handle. Configuration options are in WordPress analytics plugins.
- Fonts loaded from a font service. Extremely common in themes, and entirely avoidable. Self-host the files and the transfer disappears, with a small speed benefit as well. Choosing and hosting typefaces is covered in choosing fonts for a website.
- Video and map embeds. A single embedded video contacts the provider on page load. Use a click-to-load placeholder if the page is otherwise consent-free.
- Chat widgets and support tools. These usually load immediately and set their own cookies.
- Your CDN, host and email provider. These are processors handling data on your behalf, which is a contractual matter rather than a consent one.
Audit this by loading a page with the browser's network panel open and reading the list of domains contacted. Anything that is not your own domain is a transfer you should be able to account for.
Consent, briefly
Where a banner is required, it has to actually block the scripts until consent is given, rather than appearing over a page that already loaded them. That mechanism, and the caching problems it creates, are covered in WordPress cookie consent plugins. The important point here is ordering: reduce the number of third parties first, then add a banner for what genuinely remains. A banner over fifteen trackers is a worse outcome than no banner over two.
Retention is the quiet problem
Data you collected years ago is still data you hold.
- Form entries accumulate in the database indefinitely unless the plugin has a retention setting. Most do; almost nobody enables it. Check yours, per WordPress contact form plugins.
- Comments stay forever, including spam queues holding thousands of email addresses.
- Old user accounts for people who left years ago.
- Backups contain everything the database contained on the day they were taken, which means a deletion request is not fully honoured while old backups persist. Decide a backup retention period and enforce it, as part of the routine in how to back up a WordPress site.
Retention is where a decision costs nothing and the absence of one accumulates risk quietly.
What a plugin can and cannot do
It can render a consent banner, block known scripts before consent, record consent, add a privacy policy page, and register exporters for its own data.
It cannot decide your lawful basis, write an accurate privacy policy for your business, sign contracts with your processors, remove a tracker your theme loads, or delete the personal data sitting in six months of backups.
Treat it as a tool for the last mile, once the inventory and the decisions exist.
Common mistakes
- Installing a banner and considering it done. The banner is the smallest part.
- Blocking your own analytics while a theme still loads fonts from elsewhere. Both are transfers.
- Never running the export tool. It is the fastest way to see what you actually hold.
- Keeping form entries forever because no one changed the default.
- Copying a privacy policy from another site. It describes their data flows, not yours.
- Forgetting backups when honouring a deletion request.
- Assuming a plugin's data is covered by core's export tool. Most of the time it is not.
Verify
Open a page with the network panel and list every external domain contacted before any interaction. For each one, be able to say why it is there. Then run an export request against your own email address and compare the result against your own list of what the site stores. Finally, check the retention setting on every plugin that saves submissions, and set one everywhere it is missing. The security side of the same audit is in the WordPress security checklist.
Frequently asked
- No. A plugin can present a consent banner, block scripts before consent and help with requests. It cannot know what data you collect, why you collect it or how long you keep it, and those are the questions that matter.
- Yes, for comments. Every comment row keeps the author's IP address and browser user agent alongside the name and email. Server access logs hold IP addresses for every visitor regardless of what WordPress does.
- Because loading a font from a third-party service sends every visitor's IP address to that service before any consent is possible. Serving the same font from your own domain removes the transfer entirely.