Formidable Forms

What Formidable Forms is

Formidable Forms is a WordPress form builder plugin developed by Strategy11, a company based in the United States. It lets site owners create contact forms, surveys, registrations and advanced data driven forms that run on their own WordPress installation. Because the plugin is self hosted, the form submissions are stored in the operator own database rather than on a vendor cloud. The privacy profile therefore depends mostly on what data the forms collect and which optional integrations are switched on.

What data and cookies it collects

Forms typically collect names, email addresses, messages and any other fields the operator defines, and the plugin can also log the submitter IP address and user agent. The core plugin does not need advertising cookies to function. Cookies and external calls appear mainly through optional integrations, for example Google reCAPTCHA for spam protection, Stripe for payments, Akismet for spam filtering and Mailchimp for email marketing. Each enabled integration broadens the data that leaves the operator server.

GDPR and ePrivacy implications

Processing the personal data submitted through a form is governed by the GDPR, so the operator acts as controller and must identify a legal basis. Storing or reading any non essential cookie set by an integration falls under Art. 5(3) of the ePrivacy Directive and requires prior consent. A service like reCAPTCHA, which loads Google scripts and can set cookies, is therefore not strictly necessary in the legal sense. The operator should map each integration to a lawful basis and a cookie classification.

Consent requirements

The form submission itself can usually rely on contract or on consent, depending on the purpose, and a clear privacy notice must be shown at the point of collection. Optional integrations that set cookies need prior consent before they load, which means reCAPTCHA and similar scripts should be gated behind your consent management platform. If a form processes special categories of data, explicit consent is required. Always make participation possible without forcing acceptance of non essential features.

International data transfers

The core plugin keeps data within your own hosting, but the common integrations send data to providers in the United States. Google, Stripe, Automattic and Intuit each receive personal data when their integration is active, which constitutes a transfer to a third country. You must rely on a valid mechanism such as Standard Contractual Clauses or Data Privacy Framework certification, supported by a transfer impact assessment. Disabling unnecessary integrations is the simplest way to reduce transfer risk.

Practical compliance steps

Show a privacy notice next to each form and record the legal basis for the data you collect. Enable only the integrations you truly need, and gate any cookie setting integration behind consent so it loads after opt in. Keep a register of the providers, the data they receive and the transfer safeguards, and set retention limits for stored submissions. Review forms regularly and delete data that is no longer needed.