Redux Framework

What Redux Framework is and what it does

Redux Framework is a WordPress options framework, that is, a developer toolkit that helps theme and plugin authors build the configuration screens that site owners see inside the WordPress admin. It is maintained by ReduxCore and bundled in many commercial themes sold on marketplaces like ThemeForest. Strictly speaking it is a back end PHP library, but it also enqueues JavaScript and CSS in the WordPress admin to render its option panels, color pickers, media selectors, and live previews. Some themes call Redux helpers on the public front end, which is when privacy obligations typically come into scope.

Data and cookies collected by Redux Framework

In a default WordPress admin scenario, Redux Framework itself does not set tracking cookies. The session is governed by WordPress core cookies such as wp-settings-* and the authentication cookies, which exist regardless of Redux. Older versions of Redux Framework included an opt in or, in some releases, opt out anonymous tracking feature that sent aggregate usage statistics (active theme, plugin version, PHP version) to ReduxCore endpoints. License and update checks may transmit a domain name, license key, and product slug to redux.io. When a theme loads Redux assets on the front end, the visitors browser fetches scripts from the site, which logs an IP address and user agent server side.

GDPR and ePrivacy implications

The compliance picture depends on where Redux Framework runs. For pure admin usage by site administrators, the operator is generally both controller and data subject, and consumer facing rules like Art. 5(3) ePrivacy Directive do not apply to visitors. Once a theme exposes Redux assets to public visitors, ePrivacy is triggered for any storage or access of information on the device, and the GDPR applies to any visitor IP addresses or identifiers that reach US servers. Telemetry features, where active, qualify as processing of metadata that may be linked to a site and therefore to the natural persons operating it.

Consent requirements and legal basis

Where Redux Framework only runs in the WordPress admin and no telemetry leaves the server, no visitor consent is required. Where a theme loads Redux JavaScript on public pages, prior informed consent under Art. 5(3) ePrivacy and Art. 6(1)(a) GDPR is the safe legal basis, because the loading is not strictly necessary for a service requested by the visitor. License verification calls initiated by the administrator can usually rest on legitimate interest (Art. 6(1)(f) GDPR), provided the data flows are documented and proportionate. Telemetry options should be disabled unless a separate basis is identified.

Cross-border data transfers and practical compliance steps

ReduxCore is based in the United States and uses Cloudflare, so any license, update, or telemetry request from an EU site becomes an international transfer that needs an Art. 46 GDPR safeguard such as the EU US Data Privacy Framework or Standard Contractual Clauses. Practical steps: disable any Redux tracking option in your theme settings, audit whether your theme enqueues Redux assets on the front end and dequeue them where unnecessary, gate any remaining front end loading behind your consent banner, document license check traffic in your records of processing, and update your privacy policy to mention ReduxCore as a processor where applicable.