WordPress
WordPress is the world's most popular CMS, powering over 40% of all websites. For GDPR purposes, the core WordPress software has minimal privacy implications: it sets session cookies and comment author cookies that are strictly necessary. GDPR complexity comes from the plugin ecosystem: analytics plugins, contact form plugins, commenting systems, social share buttons, and advertising plugins each introduce their own data processing. Self-hosted WordPress GDPR compliance is the deployer's responsibility. WordPress.com (Automattic) is US-hosted requiring SCCs.
What does WordPress do?
What is WordPress?
WordPress is an open-source content management system (CMS) powering over 43% of all websites globally. It comes in two forms: WordPress.org (self-hosted, free software you run on your own server) and WordPress.com (hosted by Automattic on US infrastructure). The core WordPress software provides a minimal privacy footprint. GDPR complexity comes almost entirely from the plugin ecosystem: WordPress has over 60,000 plugins, many of which add tracking, analytics, advertising, and communication features.
WordPress core cookies
WordPress core sets: wordpress_logged_in (authentication, session), wordpress_test_cookie (verifies cookies work, session), comment_author (remembers commenter name/email for 1 year). The first two are strictly necessary for site function. The comment_author cookie is a preference cookie that improves user experience. None require consent under most DPA interpretations, though some legal teams prefer to include them in cookie notices.
The plugin GDPR minefield
Every plugin that adds external functionality creates GDPR obligations. Common offenders: Google Analytics plugins (require consent, US transfer), contact form plugins storing submissions (data retention, erasure requests), social share buttons (third-party cookie loading), comment systems like Disqus (extensive tracking), live chat plugins (consent required), and page builder plugins loading Google Fonts CDN. Audit every plugin before installation.
WordPress.com vs self-hosted
WordPress.com is hosted by Automattic (US). All site data, user data, and visitor data is processed on Automattic's US infrastructure requiring SCCs. Self-hosted WordPress on a European server keeps all data in the EU with no third-country transfer required for the hosting itself. For EU organisations with strict data residency requirements, self-hosted WordPress on an EU server is the recommended configuration.
Practical compliance steps
Install a CMP plugin (Cookiebot, Axeptio, CookieYes). Audit all plugins for GDPR implications. Remove unnecessary plugins. Replace Google Analytics with a GDPR-compliant alternative or configure consent. Self-host Google Fonts. Use a GDPR-compliant contact form plugin with data retention controls. Add a comprehensive privacy policy. For WordPress.com, sign Automattic's DPA.
WordPress and the GDPR
WordPress is classified as “Unclassified”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- WordPress core sets strictly necessary cookies (wordpress_logged_in, comment_author) that do not require consent. Any additional tracking, analytics, or advertising plugins require appropriate legal bases and consent management. Legitimate interest may apply for security and anti-spam measures (Akismet).
- Risk level
- low
- Applicable regulations
- GDPR compliance depends on server location, plugins, and embedded services. WordPress.com requires SCCs for EU users. Self-hosted WordPress GDPR compliance is entirely the deployer's responsibility.
Impact assessment (DPIA)
A DPIA is not required for standard WordPress websites. It may become relevant for membership sites processing extensive personal data, healthcare or sensitive data sites, or sites with large-scale behavioural tracking via advertising plugins.
Sample text for your banner
This website uses cookies. Essential cookies are required for basic site functions. We use additional cookies for analytics and functionality improvements. You can manage your cookie preferences below.
What WordPress sets and contacts
- Tracking method
- CMS platform, PHP-based, first-party cookies for sessions and comments, plugin ecosystem adds third-party tracking
- Server location
- Deployer-controlled (self-hosted) or United States (WordPress.com/Automattic)
- Cookieless mode available
- Yes
Cookies set (2)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| wordpress_logged_in | session | Session | WordPress authentication cookie for logged-in users: strictly necessary, no consent required |
| wp-settings | persistent | 1 year | WordPress interface preference cookie for logged-in users: strictly necessary, no consent required |
Third-party domains contacted (3)
wordpress.orgwordpress.comautomattic.com
Frequently asked questions about WordPress
Can't find your question? Write to us, we answer fast.
Is WordPress GDPR compliant?
WordPress core is minimal privacy risk. Compliance depends on plugins and hosting. Self-hosted on EU server with privacy-conscious plugins can be fully compliant. WordPress.com needs SCCs. The responsibility is yours as site operator.
What cookies does WordPress set by default?
wordpress_logged_in (authentication, session), wordpress_test_cookie (session), comment_author (1 year). No analytics or advertising cookies in core. The first two are strictly necessary.
Which WordPress plugins have GDPR issues?
Jetpack (US), Contact Form 7 (no retention controls by default), Google Site Kit (adds GA4), MonsterInsights, WooCommerce, social share plugins. Audit every plugin before installation.
Does WordPress.com require a DPA?
Yes. Sign Automattic's DPA at automattic.com/privacy. WordPress.com processes all site data on US infrastructure. The DPA includes SCCs for EU transfers.
How do I add a cookie consent banner to WordPress?
Install a CMP plugin: Cookiebot, CookieYes, Complianz, or Axeptio (all have free WordPress plugins). Integrate with Google Consent Mode v2 if using Google tools.
How do I handle GDPR requests in WordPress?
Access: Tools, Export Personal Data. Erasure: Tools, Erase Personal Data. For WooCommerce use the built-in customer data tools. Respond within 30 days.
Does WooCommerce need special GDPR configuration?
Yes. Enable: order anonymisation after set period, customer deletion, privacy policy at checkout, marketing opt-in checkbox. WooCommerce has built-in GDPR tools at WooCommerce, Settings, Privacy.
Is self-hosted WordPress better for GDPR than WordPress.com?
For EU organisations yes: no US transfers for hosting, full data sovereignty, no DPA with Automattic needed for hosting itself.
%20%20--%3E%0A%3Csvg%20height%3D%22100%25%22%20width%3D%22100%25%22%20version%3D%221.1%22%20id%3D%22Layer_1%22%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20xmlns%3Axlink%3D%22http%3A%2F%2Fwww.w3.org%2F1999%2Fxlink%22%20x%3D%220px%22%20y%3D%220px%22%0A%09%20viewBox%3D%220%200%20100%20100%22%20style%3D%22enable-background%3Anew%200%200%20100%20100%3B%22%20xml%3Aspace%3D%22preserve%22%3E%0A%3Cstyle%20type%3D%22text%2Fcss%22%3E%0A%09.st0%7Bfill%3A%23E5422B%3B%7D%0A%3C%2Fstyle%3E%0A%3Cpath%20class%3D%22st0%22%20d%3D%22M89.5%2C0H10.5C4.7%2C0%2C0%2C4.7%2C0%2C10.5v78.9C0%2C95.3%2C4.7%2C100%2C10.5%2C100h78.9c5.7%2C0%2C10.5-4.7%2C10.5-10.5V10.5%0A%09C100%2C4.7%2C95.3%2C0%2C89.5%2C0z%20M49.8%2C60.9c3.3%2C0%2C6.8-1.3%2C10.2-4.3l4.7%2C5.4c-4.9%2C4-10.5%2C6.2-16.1%2C6.2c-11.1%2C0-18.1-7.4-16.5-17.8%0A%09C33.7%2C40%2C43.2%2C32.6%2C54.3%2C32.6c5.4%2C0%2C10.4%2C2.1%2C13.9%2C6L61.6%2C44c-1.9-2.5-5-4.1-8.5-4.1c-6.7%2C0-11.8%2C4.3-12.9%2C10.5%0A%09C39.3%2C56.6%2C43%2C60.9%2C49.8%2C60.9z%22%2F%3E%0A%3C%2Fsvg%3E)
Craft CMS
Craft CMS provides a robust content management platform that enables organizations to create, organize, and distribute web content efficiently. Built with scalability and performance in mind, Craft CMS supports multi-site management, role-based access control, and advanced publishing workflows. Whether running a corporate website or a complex digital portal, Craft CMS delivers the flexibility and reliability needed to manage content at scale while maintaining optimal page load speeds and search engine visibility.
WebWave
WebWave is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. WebWave supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, WebWave enables informed decisions that improve experience and drive results.
Salesforce Experience Cloud
Salesforce Experience Cloud is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Salesforce Experience Cloud provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Salesforce Experience Cloud ensures optimal performance at scale.
%22%2F%3E%0A%3Cpath%20fill-rule%3D%22evenodd%22%20clip-rule%3D%22evenodd%22%20d%3D%22M6.21094%209.50529C6.21094%208.18764%207.24623%207.15234%208.56388%207.15234H12.2345C13.0815%207.15234%2013.7403%207.81117%2013.7403%208.75234C13.7179%209.14441%2013.552%209.51453%2013.2743%209.79222C12.9967%2010.0699%2012.6265%2010.2358%2012.2345%2010.2582H11.1051C10.6058%2010.2582%2010.127%2010.4565%209.77403%2010.8096C9.42102%2011.1626%209.2227%2011.6413%209.2227%2012.1406V19.8582C9.2227%2020.3575%209.42102%2020.8362%209.77403%2021.1893C10.127%2021.5423%2010.6058%2021.7406%2011.1051%2021.7406H12.2345C12.6265%2021.763%2012.9967%2021.9289%2013.2743%2022.2066C13.552%2022.4843%2013.7179%2022.8544%2013.7403%2023.2465C13.7403%2024.1876%2013.0815%2024.8465%2012.2345%2024.8465H8.46976C7.87811%2024.8232%207.31697%2024.5778%206.89829%2024.1591C6.4796%2023.7404%206.23417%2023.1793%206.21094%2022.5876V9.41117V9.50529ZM25.7874%209.50529C25.7874%208.18764%2024.8462%207.15234%2023.4345%207.15234H19.858C19.0109%207.15234%2018.3521%207.81117%2018.3521%208.75234C18.3746%209.14441%2018.5404%209.51453%2018.8181%209.79222C19.0958%2010.0699%2019.4659%2010.2358%2019.858%2010.2582H20.9874C21.4866%2010.2582%2021.9654%2010.4565%2022.3184%2010.8096C22.6714%2011.1626%2022.8698%2011.6413%2022.8698%2012.1406V19.7641C22.8698%2020.2633%2022.6714%2020.7421%2022.3184%2021.0951C21.9654%2021.4481%2021.4866%2021.6465%2020.9874%2021.6465H19.7639C19.3718%2021.6689%2019.0017%2021.8348%2018.724%2022.1125C18.4463%2022.3902%2018.2805%2022.7603%2018.258%2023.1523C18.258%2024.0935%2018.9168%2024.7523%2019.7639%2024.7523H23.5286C24.1526%2024.7523%2024.7511%2024.5044%2025.1924%2024.0632C25.6336%2023.6219%2025.8815%2023.0234%2025.8815%2022.3994V9.41117L25.7874%209.50529Z%22%20fill%3D%22white%22%2F%3E%0A%3Cdefs%3E%0A%3ClinearGradient%20id%3D%22paint0_linear_1745%3A124%22%20x1%3D%2216.9412%22%20y1%3D%220%22%20x2%3D%2216.9412%22%20y2%3D%2232%22%20gradientUnits%3D%22userSpaceOnUse%22%3E%0A%3Cstop%20stop-color%3D%22%23F45C43%22%2F%3E%0A%3Cstop%20offset%3D%221%22%20stop-color%3D%22%23EB3349%22%2F%3E%0A%3C%2FlinearGradient%3E%0A%3C%2Fdefs%3E%0A%3C%2Fsvg%3E)
Shortcodes Ultimate
Shortcodes Ultimate is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Shortcodes Ultimate supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Shortcodes Ultimate enables informed decisions that improve experience and.
ThemeZee Wellington
ThemeZee Wellington is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. ThemeZee Wellington integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, ThemeZee Wellington helps organizations maintain robust websites that meet user expectations.
Webflow
Webflow is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. Webflow is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, Webflow offers reliable solutions that scale with organizational needs and evolving web standards.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.