Jetpack
Jetpack is a multi feature WordPress plugin from Automattic (the company behind WordPress.com) that bundles backups, security scanning, CDN, related posts, social sharing, comments and Jetpack Stats. Several modules drop first party cookies on visitor browsers and require consent under European cookie law.
What does Jetpack do?
What is Jetpack
Jetpack is a flagship WordPress plugin developed by Automattic Inc., the same company that operates WordPress.com and WooCommerce. It bundles dozens of modules: VaultPress backups, Jetpack Protect security scanning, Jetpack Boost performance optimisation, Image CDN, Related Posts, Comments via WordPress.com, Social sharing, Subscriptions and Jetpack Stats. European publishers use Jetpack as an all in one productivity layer.
Cookies and tracking technologies
Jetpack Stats sets the tk_ai (visitor identifier, 2 years) and tk_lr (last view reference, 2 years) cookies as first party under the WordPress site domain. The Image CDN and Jetpack Boost modules do not set cookies. Jetpack Social and Comments rely on third party cookies from WordPress.com, Twitter, LinkedIn and Facebook for share buttons and login.
GDPR and ePrivacy implications
Jetpack Stats and Jetpack Social require consent under Article 5(3) ePrivacy. Server side modules (Backups, Protect, Boost, Image CDN) operate on the publisher backend and rely on legitimate interest under Article 6(1)(f) GDPR for performance and security purposes. Automattic acts as a processor under Article 28 GDPR.
Consent requirements
Prior, freely given, specific, informed and unambiguous consent is required for the Stats and Social modules. A consent management platform should disable Jetpack Stats and Social before consent. Jetpack offers a Privacy submodule and a consent toggle that integrates with most CMPs to keep the Stats tracker off by default.
Data transfers outside the EEA
Automattic Inc. processes Jetpack data on US infrastructure with global edge nodes. Automattic self certifies under the EU US Data Privacy Framework, providing an adequacy basis for transfers from the EEA. Standard Contractual Clauses are included in the Automattic DPA as a fallback for any non DPF subprocessor.
Practical compliance steps
Sign the Automattic DPA, gate Jetpack Stats and Social behind your consent management platform, document the US transfer under the EU US Data Privacy Framework, document each enabled module in your record of processing activities, configure long term retention only where necessary, and consider Jetpack Boost (no cookies, performance only) as a privacy friendly default for new sites.
Jetpack and the GDPR
Jetpack is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy is required for the Jetpack Stats and Jetpack Social modules because they drop first party cookies (tk_ai, tk_lr) for visitor counting and share button analytics. Other modules (Backups, Protect, Image CDN) operate server side and rely on legitimate interest.
- Risk level
- medium
- Applicable regulations
- GDPR, ePrivacy Directive, EU US Data Privacy Framework, national cookie laws (TTDSG, LCEN, LSSI), CNIL recommendations on website analytics
Impact assessment (DPIA)
A DPIA is recommended when Jetpack Stats is deployed across a large WordPress audience, when Jetpack Comments collects user data via WordPress.com login, or when Jetpack Social shares attribution data with Twitter, LinkedIn and Facebook APIs. Document module by module legal basis.
Sample text for your banner
Our WordPress site uses Jetpack (Automattic Inc., USA) for security, performance and analytics. The Jetpack Stats module drops tk_ai and tk_lr cookies on your browser to count unique visitors. Other Jetpack modules run server side. Stats and Social modules are activated only with your consent.
What Jetpack sets and contacts
- Tracking method
- Multi feature WordPress plugin from Automattic that adds backups, security scanning, CDN, related posts, social sharing, comments and Jetpack Stats. The Stats module deploys a JavaScript tracker that drops first party cookies for visitor counting
- Server location
- Automattic Inc. on multiple cloud providers (AWS, Bare metal datacenters) with primary infrastructure in the United States; some EU edge nodes available
- Cookieless mode available
- Yes
- Data transferred outside the EU
- Automattic Inc. is established in San Francisco, United States. Jetpack Stats and related modules process visitor data on US infrastructure. Automattic self certifies under the EU US Data Privacy Framework. Standard Contractual Clauses are included in the Automattic DPA.
Cookies set (4)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| tk_ai | first_party | 2 years | Jetpack Stats first party visitor identifier cookie used to count unique visitors and aggregate page views in the Jetpack Stats dashboard. Set only when the Stats module is enabled. |
| tk_lr | first_party | 2 years | Jetpack Stats last view reference cookie used to attribute the previous referrer to a page view. Set together with tk_ai when the Stats module is enabled. |
| tk_qs | first_party | Session | Jetpack Stats session level cookie used during page tracking to deduplicate events within a single browsing session. |
| wp-settings-* | first_party | 1 year | WordPress user settings cookie that Jetpack reads to apply preferences for authenticated editors using the Jetpack admin interface. |
Third-party domains contacted (8)
stats.wp.compixel.wp.comi0.wp.comi1.wp.comi2.wp.comjetpack.wordpress.compublic-api.wordpress.comwp.com
Frequently asked questions about Jetpack
Can't find your question? Write to us, we answer fast.
Which cookies does Jetpack set?
Jetpack Stats sets tk_ai and tk_lr (first party, WordPress site domain, 2 years) for visitor counting. Image CDN and Jetpack Boost do not set cookies. Jetpack Social and Comments load third party cookies from WordPress.com, Twitter, LinkedIn and Facebook for share buttons and login.
Does Jetpack require user consent?
Yes for the Stats and Social modules. Server side modules (Backups, Protect, Boost, Image CDN) do not require consent. The Comments module via WordPress.com login may require consent depending on configuration.
What legal basis applies to Jetpack?
Stats and Social rely on consent under Article 6(1)(a) GDPR. Server side modules rely on legitimate interest under Article 6(1)(f) GDPR for performance and security. Automattic is a processor under Article 28 GDPR.
Does Jetpack transfer data to the United States?
Yes. Automattic Inc. processes Jetpack data on US infrastructure. Automattic self certifies under the EU US Data Privacy Framework. Standard Contractual Clauses are included in the Automattic DPA.
Is a DPIA required for Jetpack?
A DPIA is recommended when Jetpack Stats is deployed on large WordPress audiences, when Jetpack Comments collects WordPress.com identifiers or when Jetpack Social shares attribution data with Twitter, LinkedIn and Facebook APIs.
How do I implement Jetpack compliantly?
Sign the Automattic DPA, gate Jetpack Stats and Social behind a consent management platform, document each enabled module module by module, configure retention only where needed, and consider Jetpack Boost (no cookies) as a privacy friendly default for performance.
Are there alternatives to Jetpack?
Privacy friendly alternatives by module: backups via UpdraftPlus or BlogVault, security via Wordfence or iThemes Security, performance via WP Rocket or LiteSpeed Cache, analytics via Matomo Analytics or Plausible (both have WordPress plugins), comments via Replyable or native WordPress comments.
How do I update my cookie policy for Jetpack?
List tk_ai and tk_lr in the analytics category with name, domain, duration and purpose. Disclose the US transfer and the EU US Data Privacy Framework certification. Document the third party cookies from Jetpack Social and Comments separately, and link to the Automattic privacy policy.
Decibel
Decibel is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Decibel supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Decibel enables informed decisions that improve experience and drive results.
Patient Prism
Patient Prism is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Patient Prism supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Patient Prism enables informed decisions that improve experience and drive results.
Sitefinity Insight
Sitefinity Insight is a web analytics platform that provides businesses with actionable insights into website traffic, user behavior, and conversion performance. It offers real-time data collection, customizable dashboards, and advanced reporting to help organizations understand their audience. Sitefinity Insight supports event tracking, funnel analysis, and audience segmentation, enabling data-driven decision making that improves user experience and drives business growth across digital channels.
Countly
Countly is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Countly supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Countly enables informed decisions that improve experience and drive results.
Nepcha Analytics
Nepcha Analytics is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Nepcha Analytics supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Nepcha Analytics enables informed decisions that improve experience and drive results.
FullContact
FullContact is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. FullContact offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, FullContact empowers organizations to optimize strategy and maximize return on investment.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.