Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Automattic managed WordPress blogging platform, distinct from self hosted WordPress.org. Includes WordPress.com Stats and Jetpack, and WordAds on free plans, with data sent to the United States.
WordPress.com is the managed blogging and website platform hosted by Automattic Inc. It is distinct from self hosted WordPress.org, which is the open source software you install on your own server. On WordPress.com, Automattic hosts your site and provides built in features such as WordPress.com Stats, Jetpack and, on free and lower tier plans, WordAds advertising.
WordPress.com loads analytics pixels from stats.wp.com and pixel.wp.com and may set strictly necessary login cookies such as wordpress_ and wp-settings_, plus TK analytics cookies including tk_ai, tk_lr and tk_qs. On free and lower tier plans, WordAds adds advertising cookies. The pixels count visits and, for ads, support delivery and measurement.
This service is the hosted WordPress.com, not self hosted WordPress.org. With WordPress.org you control hosting and which plugins run, so analytics and ads are only present if you add them. WordPress.com bundles Stats and, on lower tiers, ads by default, which changes the consent and transfer profile.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Login and session cookies that are strictly necessary to run a site the user logged into are exempt from consent. WordPress.com Stats, Jetpack TK analytics and WordAds are not strictly necessary, so under the ePrivacy Directive they require prior consent, with consent under Article 6(1)(a) GDPR as the lawful basis.
Automattic processes data in the United States, a third country. Loading the stats pixels and ad scripts transfers visitor data, including IP addresses, to the United States under the EU Standard Contractual Clauses. Disclose this transfer and the safeguards in your privacy notice.
Use a consent banner to gate Stats, Jetpack analytics and WordAds until consent, and keep strictly necessary login cookies separate. On a paid plan you can disable ads, and you can limit or anonymise stats. List WordPress.com in your cookie policy and record the United States transfer.
Websites using WordPress.com must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is useful because WordPress.com combines stats analytics, Jetpack TK cookies and WordAds advertising on lower tier plans. Assess the cookies set, the United States transfer under SCCs and the separation of strictly necessary login cookies.
Sample consent text
This WordPress.com site uses Stats, Jetpack and, depending on the plan, WordAds advertising. These features set cookies and transfer data to Automattic in the United States. Do you consent to these stats and advertising cookies?
Third-party domains contacted
wordpress.comwp.comstats.wp.compixel.wp.coms0.wp.compublic-api.wordpress.comwidgets.wp.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| tk_ai | Third-party | Persistent | Automattic TK analytics cookie that stores an anonymous identifier for Jetpack and WordPress.com Stats measurement. |
| tk_lr | Third-party | 1 year | Automattic TK referrer analytics cookie used to record the landing referrer for stats. |
| tk_qs | Third-party | Session | Automattic TK analytics cookie used to gather short term session information for stats. |
| wordpress_ | First-party | Session | Strictly necessary WordPress login authentication cookie set when a user signs in to manage the site. |
| wp-settings- | First-party | 1 year | Functional cookie that stores a logged in user interface preferences for the WordPress admin. |
This service may collect user data. Ensure GDPR compliance with FlowConsent.
WordPress.com may set strictly necessary login cookies such as wordpress_ and wp-settings_, TK analytics cookies including tk_ai, tk_lr and tk_qs for Jetpack and WordPress.com Stats, and WordAds advertising cookies on free and lower tier plans.
Yes. WordPress.com Stats, Jetpack TK analytics and WordAds are not strictly necessary, so they require prior consent under the ePrivacy Directive before they load.
Stats and advertising cookies rely on consent under Article 6(1)(a) GDPR. The strictly necessary login and session cookies such as wordpress_ and wp-settings_ are exempt from consent.
Yes. WordPress.com is operated by Automattic in the United States, so loading the stats pixels and ad scripts transfers visitor data, including IP addresses, to the United States under the EU Standard Contractual Clauses.
A DPIA is recommended where you use Stats, Jetpack analytics and WordAds together, as these combine measurement and advertising with a United States transfer. Assess the cookies, the consent flow and the SCC based transfer.
Use a consent banner to gate Stats, Jetpack analytics and WordAds until consent, keep strictly necessary login cookies separate, list WordPress.com in your cookie policy and record the United States transfer in your processing records.
On a paid WordPress.com plan you can disable WordAds, which removes the advertising cookies. You can also limit or anonymise Stats, or move to self hosted WordPress.org where you choose whether to run analytics or ads at all.
Add an entry naming Automattic, the Stats and Jetpack TK cookies, WordAds advertising cookies where applicable, the strictly necessary login cookies, and the United States transfer under the SCCs, with a link to Automattic's cookie policy.