Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Gravatar is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. Gravatar is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, Gravatar offers reliable solutions that scale with organizational needs and evolving web standards.
Gravatar, the Globally Recognised Avatar service, is operated by Automattic Inc. in San Francisco. Built into WordPress core and used by thousands of comment systems, forums and SaaS applications, it lets users associate a profile picture with their email address. Every avatar request to gravatar.com transfers the visitor IP, user agent and a hash of the email to the United States.
When a page needs to display an avatar (for a comment author, a forum member, a profile widget) the website hashes the email address (MD5 historically, SHA 256 in modern versions) and builds a URL of the form secure.gravatar.com/avatar/{hash}. The browser fetches this image directly from Automattic, which can therefore log the visitor IP, user agent and the page that triggered the request via the Referer header.
Gravatar normally does not set tracking cookies on the embedding website, but it may set Automattic session cookies (wpcom_*, tk_*) when the visitor is logged in to WordPress.com. The visitor IP, the email hash and the Referer URL are transmitted on every avatar request and stored in Automattic logs. The CNIL has confirmed that a hashed email is still personal data under Recital 26 GDPR.
German courts (LG Munich, 2022) ruled that loading external resources that leak the IP address without consent breaches the GDPR. Gravatar requests follow exactly the same pattern. Although the avatar itself is not a cookie, the IP transfer to a US third party falls under Art. 6 GDPR and the email hash falls under Art. 4(1). Consent is the safest legal basis for an EU facing website.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Automattic is self certified under the EU US Data Privacy Framework, which serves as an Art. 45 adequacy decision for transfers to certified US importers. If the DPF is invalidated again (the previous Privacy Shield and Safe Harbor both fell), transfers must rely on Standard Contractual Clauses with supplementary measures and a documented Transfer Impact Assessment. Always re check Automattic certification status at dataprivacyframework.gov.
Disable Gravatar in WordPress until consent is granted (Settings > Discussion > Show Avatars), or use a privacy proxy such as the Avatar Privacy plugin that hosts avatars locally. Block Gravatar through your CMP under the functional or marketing category. Document Automattic as a US sub processor in your records of processing, your privacy notice and your cookie banner. If you accept comments, allow visitors to use a generic identicon or local fallback.
Websites using Gravatar must obtain user consent under GDPR regulations.
Third-party domains contacted
gravatar.comsecure.gravatar.com0.gravatar.comen.gravatar.comautomattic.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| wpcom_loggedin | third_party | 2 weeks | Set by Automattic for visitors signed in to WordPress.com when avatars are fetched. |
| tk_ai | third_party | 1 year | Anonymous identifier used by Automattic Tracks for product analytics across Automattic properties. |
| tk_lr | third_party | 1 year | Stores the landing page referrer for Automattic Tracks analytics. |
Gravatar is an essential service, but transparency matters. Manage all your consent with FlowConsent.
Gravatar itself rarely sets cookies on the embedding website. When the visitor is authenticated on WordPress.com, Automattic session cookies such as wpcom_loggedin, wp_api_sec, tk_ai or tk_lr may be present on the gravatar.com response. These are third party cookies that require consent.
Yes, in the EEA. Although the avatar request does not set first party cookies, it transfers the visitor IP and an email hash to Automattic in the United States. Under Art. 6 GDPR the safest legal basis is consent, especially considering the LG Munich ruling on similar Google Fonts requests.
Consent (Art. 6(1)(a) GDPR) is recommended for an EU facing website. Legitimate interest under Art. 6(1)(f) can be argued only if local avatar fallbacks are offered and the Transfer Impact Assessment is documented. In WordPress, the simplest path is to disable remote avatars by default.
Yes. Every Gravatar request reaches Automattic infrastructure in the United States. Automattic relies on the EU US Data Privacy Framework for the transfer. You must verify the current certification status of Automattic on dataprivacyframework.gov and document the transfer in your records of processing.
A standalone DPIA is generally not required, but if Gravatar is combined with comment systems, analytics or marketing tags the overall website DPIA should mention the email hash, the IP exposure and the US transfer. A Transfer Impact Assessment is mandatory.
Either disable remote avatars in WordPress (Settings > Discussion > uncheck Show Avatars), or install a privacy proxy (Avatar Privacy plugin) that caches Gravatar locally, or block Gravatar through your CMP behind a marketing category. Provide a generic identicon as fallback. Document the choice in your privacy notice.
Self hosted alternatives include Libravatar (federated, EU friendly), Avatar Privacy (WordPress plugin), Boring Avatars (procedural SVG identicons) or simply hosting uploaded avatars on your own server or object storage. Each removes the US transfer issue entirely.
When Automattic updates its privacy policy, terms or transfer mechanism, reflect the change in your cookie table and privacy notice. If the DPF status changes (suspension or invalidation), bump the consent banner version to invalidate consents that were collected under the previous regime.