Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
WPML (WordPress Multilingual) is the most widely deployed multilingual plugin for WordPress, developed by OnTheGoSystems. It enables WordPress sites to serve content in multiple languages, manage translations through professional or automated workflows, and switch language via URL, subdomain, or cookie. WPML itself stores everything in the host WordPress database; its automatic translation feature can route page content through third-party providers like DeepL, Google Translate, or Microsoft Translator.
WPML (WordPress Multilingual) is the most widely deployed multilingual plugin for WordPress, developed since 2007 by OnTheGoSystems. It allows a WordPress site to serve posts, pages, custom post types, taxonomies, menus, and theme strings in multiple languages, with URL strategies based on directory, subdomain, or parameter. WPML also bundles a String Translation module, a Translation Management module, and the WPML Automatic Translation engine that can call external machine translation providers.
At the site level: language preference of the visitor (cookie or URL), translated copies of the site content stored in the WordPress database, and the editorial activity of translators and project managers. At the translation level: page strings sent to the selected provider when automatic translation is enabled. WPML does not collect visitor analytics or marketing identifiers and does not phone home with usage telemetry beyond the licence check.
The WPML language cookie (_icl_current_language) is functional: it stores a user choice required for the site to serve content correctly. Most EU supervisory authorities accept that strictly functional preference cookies do not require prior consent under ePrivacy. The editorial workflows process site content (which may include personal data) under the controller responsibility. Automatic translation introduces a subprocessor relationship: the page strings transit through the chosen provider.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
WPML itself does not transfer data internationally because it runs on the host server. Automatic translation transfers depend on the provider: DeepL is hosted in Germany (no transfer for EU sites), Google Translate processes data in the US under SCCs and DPF, Microsoft Translator can be configured for EU regions. Pick the provider that matches your transfer strategy.
Treat the WPML language cookie as functional in the privacy notice. For automatic translation, sign the DPA of the chosen provider (DeepL for EU residency, Google or Microsoft otherwise), document the subprocessor in the RoPA, and avoid pushing pages containing special category personal data through external machine translation. Mention WPML in the technical stack section of the privacy notice.
Websites using WPML must obtain user consent under GDPR regulations.
DPIA considerations
WPML by itself processes very little personal data: a language preference cookie or URL parameter, the translation strings (which can incidentally include personal data published on the site), and the editorial team activity (translators, project managers). Key DPIA considerations: (1) the language preference cookie can be classified as functional or, depending on its persistence and the operator, as a preference cookie subject to consent under TTDSG; (2) when automatic translation is enabled, the page strings are sent to a third party (Google, DeepL, Microsoft) and may include any personal data published on the page; (3) DeepL processes data in Germany, which simplifies EU compliance compared to US-based providers; (4) the translator workflow may involve external translation agencies, which become subprocessors.
Sample consent text
Our website uses WPML to serve content in multiple languages. WPML stores your language preference in a small cookie so the right version is shown on your next visit. If automatic translation is enabled, page content may be sent to a translation provider (DeepL based in Germany, Google Translate or Microsoft Translator based in the US) before being displayed. Personal data published on the page is never used for profiling.
Third-party domains contacted
wpml.orgwww.wpml.orgapi.wpml.orgwpml.deepl.comtranslate.googleapis.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _icl_current_language | Functional / Preference | 1 year | Stores the language preference selected by the visitor so the WPML language switcher serves the correct localised content on subsequent visits. |
| _icl_visitor_lang_js | Functional / Preference | 1 day | JavaScript-side helper cookie used to detect the active language for client-side scripts and AJAX calls performed by the WPML language switcher. |
| wpml_browser_redirect_test | Strictly necessary / Session | Session | Test cookie used by the WPML browser-language redirect feature to verify that cookies are enabled in the visitor browser before redirecting to the matching language version. |
WPML collects user analytics data — you legally need a consent banner. Try FlowConsent free.
WPML sets one main cookie, _icl_current_language, that stores the visitor language preference (typically one year). It also uses _icl_visitor_lang_js for the same purpose in JavaScript contexts. Both are first-party functional cookies tied to the language switcher.
For the strictly necessary language preference cookie, no consent is generally required because it stores a user choice strictly necessary to serve the right content. If automatic translation is enabled and the cookie is used for analytics or marketing purposes, consent may be required.
Legitimate interest (Art. 6(1)(f) GDPR) for serving translated content, and contract performance (Art. 6(1)(b)) for the editorial workflow. The language cookie is functional and does not require consent under most EU supervisory authority guidance.
WPML itself runs on your server with no third-party transfer. With automatic translation, the page strings are sent to the chosen provider: DeepL (Germany, no transfer for EU sites), Google Translate (US, SCCs and DPF), or Microsoft Translator (configurable region, including EU).
Usually no. WPML processes very little personal data on its own. A short DPIA is recommended only if you push large volumes of customer or community content through external automatic translation and the content includes special category data.
Document the language cookie as functional, pick an EU-friendly automatic translation provider (DeepL by default), sign the provider DPA, document the subprocessor in your RoPA, and exclude pages with special category data from automatic translation flows.
Other multilingual options for WordPress include Polylang (France), TranslatePress (Romania), Weglot (France, SaaS proxy), MultilingualPress, qTranslate-XT (open source). Headless multilingual setups can use Strapi i18n, Sanity localised fields, or Drupal multilingual.
Add a row for _icl_current_language in the strictly-necessary or functional section: name, purpose (store language preference), duration (1 year), and a note that the cookie is first-party. Mention WPML and the automatic translation provider in the privacy notice when relevant.