WP Rocket

No. WP Rocket does not set analytics, advertising or profiling cookies. It only uses functional cache variation logic that respects existing cookies (your CMP cookie, the WordPress logged in cookie) to serve the right cached page version to each visitor.

No. WP Rocket does not require consent because it does not drop any cookie on visitor browsers. You still need consent for the analytics, advertising and embedded scripts that may be added to your WordPress site through other plugins or themes.

WP Rocket processing relies on legitimate interest under Article 6(1)(f) GDPR for the publisher (performance optimisation and bandwidth reduction). The licence email address and support requests handled by WP Media SAS rely on contract under Article 6(1)(b) GDPR.

WP Rocket itself transfers no visitor data. Licence checks contact wp-rocket.me in France. If you enable RocketCDN (StackPath powered), asset requests are routed through global StackPath edges including the United States. In that scenario sign the StackPath DPA and document the transfer.

No. WP Rocket does not process personal data of visitors beyond rotating IPs in server logs. A short risk assessment is useful when activating RocketCDN to document the additional processor and the transfer to US edges.

Keep WP Rocket and WordPress core up to date, configure the Mandatory Cookies setting to include your consent management platform cookie name (CookieConsent, cookieyes-consent, OptanonConsent), exclude checkout and account pages from cache, host the WordPress site in the EEA and audit RocketCDN if enabled.

Alternatives include LiteSpeed Cache (free, lightweight), W3 Total Cache (free), WP Super Cache (free, by Automattic), Cache Enabler (free, by KeyCDN), Swift Performance and Hummingbird. None of these set tracking cookies either; the main difference is in performance, configuration and pricing.

You usually do not need a dedicated entry for WP Rocket because it sets no tracking cookies. Mention it as a technical caching plugin in the section that describes hosting and performance, and if RocketCDN is enabled add a paragraph about the StackPath CDN and the related transfer outside the EEA.

WP Rocket sets no cookies of its own on the visitor's device. It does read existing WordPress cookies such as wordpress_logged_in_*, wp_postpass_*, comment_author_*, and the WooCommerce cart and session cookies, because these are the standard signals that tell a caching engine, do not serve a generic cached page to this visitor. Reading those cookies is necessary for the cache to behave correctly and does not create a separate storage event under Article 5(3) ePrivacy. Some configurations of Cloudflare APO can cause Cloudflare to set a __cfduid or cf_clearance cookie on top, that is Cloudflare's own cookie, not WP Rocket's.

No, the plugin itself does not require consent. It is a server side optimisation that processes no personal data of visitors and stores nothing on their device. The processing it performs falls outside the scope of Article 5(3) ePrivacy because nothing is written to the terminal equipment, and outside any consent based legal basis under GDPR because there is no personal data of visitors being processed by the plugin. Consent may become relevant for specific add ons, for example if Cloudflare APO sets non essential cookies, in which case those cookies, not the plugin, trigger the consent obligation.

For the small amount of processing that does happen, Article 6(1)(f) GDPR, legitimate interest, is the relevant basis. The interest is delivering a fast, stable and resource efficient website to the user, which the EDPB has consistently recognised as a legitimate interest, and the processing is proportionate because it does not single out individuals or build profiles. Article 6(1)(b), performance of a contract, applies in parallel to licence administration between the controller and WP Media. No consent based or vital interest based grounds are needed for the plugin itself.

The plugin itself does not. WP Rocket runs on your own server and communicates with WP Media's infrastructure in France for licence checks and updates, exchanging your domain and licence key rather than visitor data. Optional integrations change the answer, RocketCDN distributes static assets via a global edge network and can therefore touch non EU regions, Cloudflare APO uses Cloudflare's worldwide network, and Imagify processes images on its own EU servers. If you enable RocketCDN or Cloudflare APO, document the transfer with Standard Contractual Clauses and update your privacy notice accordingly.

A full DPIA under Article 35 GDPR is not required for WP Rocket alone, the plugin does not engage in any of the high risk categories such as systematic monitoring, large scale processing of special categories, or evaluation of individuals. A short entry in the record of processing activities under Article 30 is sufficient. A DPIA can become advisable if you stack WP Rocket with global CDN add ons, enable verbose performance logging that captures IP addresses, or combine it with analytics platforms that introduce profiling, because then the overall processing operation, not the plugin itself, may cross the threshold.

Install the plugin, accept the licence terms with WP Media, and review the settings tab by tab. Keep cache exclusions for logged in users and recent commenters enabled, this is the default and avoids serving personalised content from cache. If you do not need a global CDN, leave RocketCDN off, this keeps everything inside your own server. If you do enable RocketCDN, Cloudflare APO or Imagify, sign the relevant DPAs and add the providers to your record of processing. Avoid enabling verbose debug logging in production unless you have a clear retention policy, and apply the same patch discipline you apply to WordPress core.

The closest commercial alternative is FlyingPress, a French built premium caching plugin with a similar privacy profile. LiteSpeed Cache is free, very fast, and developed by LiteSpeed Technologies in the United States, although it runs entirely on your server it benefits from a LiteSpeed web server or compatible edge. W3 Total Cache is a long standing free option maintained by BoldGrid in the United States, feature rich but more complex to tune. WP Super Cache is the free option from Automattic, simple and conservative. For server side caching outside the plugin layer entirely, NGINX FastCGI cache or Varnish remain strong choices for high traffic sites.

Mentioning WP Rocket is optional because it sets no cookies and processes no visitor data. If you want full transparency, add a short paragraph under technical and organisational measures, for example, We use WP Rocket, a caching plugin developed by WP Media SAS in France, to deliver pages faster, the plugin runs on our server, sets no cookies of its own, and does not transmit visitor data to third parties. If RocketCDN, Cloudflare APO or Imagify is also active, list those providers separately as processors with their locations and the transfer mechanism in place.