The Events Calendar

What The Events Calendar is

The Events Calendar is a popular WordPress plugin published by StellarWP that lets site owners create and display events, venues and organisers. It is installed and run on the operator own WordPress server, so most processing stays within the hosting environment the operator already controls. The plugin can optionally embed Google Maps for venue locations, load Google Fonts for typography and show Gravatar avatars, and it can export events through iCal and Google Calendar feeds. The privacy questions arise mainly from these optional external embeds rather than from the calendar itself.

What data and cookies it involves

The core plugin is essentially cookieless for visitors and relies on standard WordPress session handling for logged in administrators. When Google Maps is embedded, Google can set its own cookies and receives the visitor IP address and the page being viewed. Loading Google Fonts directly from Google also transmits the IP address to Google, and Gravatar avatars expose a hashed email and the IP address to Automattic. Operators who self host fonts and disable map embeds can run the calendar with no meaningful third party data flows.

GDPR and ePrivacy implications

Under Art. 5(3) of the ePrivacy Directive, loading non essential third party assets that read or write information on the visitor device requires prior consent. German and other European courts have treated Google Fonts loaded from Google as a transfer of personal data requiring a legal basis. The operator remains the controller for these embeds and must be able to show a valid basis. Displaying the calendar from the own server, by contrast, can usually rely on legitimate interest.

Consent requirements

Where Google Maps, externally hosted Google Fonts or Gravatar are active, the safe approach is to block these assets until the visitor gives consent. A consent banner or a click to load placeholder for maps satisfies Art. 6(1)(a) GDPR and the ePrivacy prior consent rule. If the operator self hosts fonts and removes maps, no consent is needed for the calendar itself. The consent state must be logged and revocable.

International data transfers

Google and Automattic are United States companies, so any IP address sent to Google Maps, Google Fonts or Gravatar is a transfer to a third country. These transfers can rely on the EU US Data Privacy Framework where the recipient is certified, otherwise on Standard Contractual Clauses backed by a transfer impact assessment. The simplest way to remove the transfer risk is to self host fonts and avoid external maps. Operators should record which mechanism applies to each remaining embed.

Practical compliance steps

Audit which external embeds are enabled, then self host Google Fonts and replace live maps with a consent gated placeholder. Add a consent banner that blocks Google assets and Gravatar until the visitor agrees, and log every consent decision. Update the privacy policy to name Google and Automattic as recipients and to describe the third country transfers. Review the configuration after each plugin update, because new features can reintroduce external calls.